changeset:   91536:f2e6c33ce3e9
branch:      2.7
parent:      91530:b10caad6a052
user:        Zachary Ware <zachary.ware@gmail.com>
date:        Thu Jul 03 10:57:44 2014 -0500
files:       Lib/test/test_winreg.py Misc/NEWS PC/_winreg.c
description:
Issue #21151: Fixed a segfault in the _winreg module.

When ``None`` was passed as a ``REG_BINARY`` value to SetValueEx,
PyMem_DEL was called on an uninitialized buffer.  Patch by John Ehresman.

(Also an incidental typo fix in a comment in test_winreg)


diff -r b10caad6a052 -r f2e6c33ce3e9 Lib/test/test_winreg.py
--- a/Lib/test/test_winreg.py	Thu Jul 03 00:30:52 2014 +0100
+++ b/Lib/test/test_winreg.py	Thu Jul 03 10:57:44 2014 -0500
@@ -341,7 +341,7 @@
     def test_queryvalueex_return_value(self):
         # Test for Issue #16759, return unsigned int from QueryValueEx.
         # Reg2Py, which gets called by QueryValueEx, was returning a value
-        # generated by PyLong_FromLong. The implmentation now uses
+        # generated by PyLong_FromLong. The implementation now uses
         # PyLong_FromUnsignedLong to match DWORD's size.
         try:
             with CreateKey(HKEY_CURRENT_USER, test_key_name) as ck:
@@ -354,6 +354,19 @@
         finally:
             DeleteKey(HKEY_CURRENT_USER, test_key_name)
 
+    def test_setvalueex_crash_with_none_arg(self):
+        # Test for Issue #21151, segfault when None is passed to SetValueEx
+        try:
+            with CreateKey(HKEY_CURRENT_USER, test_key_name) as ck:
+                self.assertNotEqual(ck.handle, 0)
+                test_val = None
+                SetValueEx(ck, "test_name", 0, REG_BINARY, test_val)
+                ret_val, ret_type = QueryValueEx(ck, "test_name")
+                self.assertEqual(ret_type, REG_BINARY)
+                self.assertEqual(ret_val, test_val)
+        finally:
+            DeleteKey(HKEY_CURRENT_USER, test_key_name)
+
 
 
 @unittest.skipUnless(REMOTE_NAME, "Skipping remote registry tests")
diff -r b10caad6a052 -r f2e6c33ce3e9 Misc/NEWS
--- a/Misc/NEWS	Thu Jul 03 00:30:52 2014 +0100
+++ b/Misc/NEWS	Thu Jul 03 10:57:44 2014 -0500
@@ -13,6 +13,9 @@
 Library
 -------
 
+- Issue #21151: Fixed a segfault in the _winreg module when ``None`` is passed
+  as a ``REG_BINARY`` value to SetValueEx.  Patch by John Ehresman.
+
 - Issue #21090: io.FileIO.readall() does not ignore I/O errors anymore. Before,
   it ignored I/O errors if at least the first C call read() succeed.
 
diff -r b10caad6a052 -r f2e6c33ce3e9 PC/_winreg.c
--- a/PC/_winreg.c	Thu Jul 03 00:30:52 2014 +0100
+++ b/PC/_winreg.c	Thu Jul 03 10:57:44 2014 -0500
@@ -883,8 +883,10 @@
         /* ALSO handle ALL unknown data types here.  Even if we can't
            support it natively, we should handle the bits. */
         default:
-            if (value == Py_None)
+            if (value == Py_None) {
                 *retDataSize = 0;
+                *retDataBuf = NULL;
+            }
             else {
                 void *src_buf;
                 PyBufferProcs *pb = value->ob_type->tp_as_buffer;