Skip to content

locale.strxfrm() crashes on DragonFly BSD: wcsxfrm() does not support zero size #154176

Description

@serhiy-storchaka

Crash report

locale.strxfrm() segfaults on DragonFly BSD 6.4 on every call, in any locale including C:

./python -c "import locale; locale.strxfrm('a')"
Segmentation fault (core dumped)
#0  wcsncpy ()    from /lib/libc.so.8
#1  wcsxfrm_l ()  from /lib/libc.so.8
#2  wcsxfrm ()    from /lib/libc.so.8
#3  _locale_strxfrm_impl at Modules/_localemodule.c:459

This is a regression from gh-130567 (2a2bc82), which introduced the size query wcsxfrm(NULL, s, 0). DragonFly's wcsxfrm() does not support zero size: it dereferences the destination (POSIX allows a null pointer when the size is 0), and its C-locale path does the equivalent of wcsncpy(dest, src, len-1), which for len = 0 copies the whole string. In the test suite the crash killed the test_locale worker and aborted the whole run.

The fix is to query the size with a real one-element buffer, which is well-defined everywhere.

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.15pre-release feature fixes, bugs and security fixes3.16new features, bugs and security fixesOS-unsupportedextension-modulesC modules in the Modules dirtype-crashA hard crash of the interpreter, possibly with a core dump

    Fields

    No fields configured for issues without a type.

    Projects

    Status
    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions