bpo-37926: Fix PySys_SetArgvEx(0, NULL, 0) crash (GH-15415) (GH-15420)

vstinner · web-flow · commit ca9ae94a2aba · 2019-08-23T12:22:14.000+01:00
empty_argv is no longer static in Python 3.8, but it is declared in a temporary scope, whereas argv keeps a reference to it. empty_argv memory (allocated on the stack) is reused by make_sys_argv() code which is inlined when using gcc -O3. Define empty_argv in PySys_SetArgvEx() body, to ensure that it remains valid for the whole lifetime of the PySys_SetArgvEx() call. (cherry picked from commit c486825)
diff --git a/Misc/NEWS.d/next/C API/2019-08-23-11-35-55.bpo-37926.hnI5IQ.rst b/Misc/NEWS.d/next/C API/2019-08-23-11-35-55.bpo-37926.hnI5IQ.rst
@@ -0,0 +1 @@
+Fix a crash in ``PySys_SetArgvEx(0, NULL, 0)``.
diff --git a/Python/sysmodule.c b/Python/sysmodule.c
@@ -3080,9 +3080,10 @@ make_sys_argv(int argc, wchar_t * const * argv)
 void
 PySys_SetArgvEx(int argc, wchar_t **argv, int updatepath)
 {
+    wchar_t* empty_argv[1] = {L""};
+
     if (argc < 1 || argv == NULL) {
         /* Ensure at least one (empty) argument is seen */
-        wchar_t* empty_argv[1] = {L""};
         argv = empty_argv;
         argc = 1;
     }

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	+Fix a crash in ``PySys_SetArgvEx(0, NULL, 0)``.
Original file line number	Diff line number	Diff line change
`@@ -3080,9 +3080,10 @@ make_sys_argv(int argc, wchar_t * const * argv)`
`3080`	`3080`	`void`
`3081`	`3081`	`PySys_SetArgvEx(int argc, wchar_t **argv, int updatepath)`
`3082`	`3082`	`{`
	`3083`	`+ wchar_t* empty_argv[1] = {L""};`
	`3084`	`+`
`3083`	`3085`	`if (argc < 1 \|\| argv == NULL) {`
`3084`	`3086`	`/* Ensure at least one (empty) argument is seen */`
`3085`		`- wchar_t* empty_argv[1] = {L""};`
`3086`	`3087`	`argv = empty_argv;`
`3087`	`3088`	`argc = 1;`
`3088`	`3089`	`}`