[New-bugs-announce] [issue23927] getargs.c skipitem() doesn't skip 'w*'

Larry Hastings report at bugs.python.org
Mon Apr 13 04:44:28 CEST 2015

New submission from Larry Hastings:

tl;dr: skipitem() in Python/getsargs.c doesn't know about the 'w*' format unit, which could lead to a crash.  It should know about it.


* you have an extension that parses its arguments with
  PyArg_ParseTupleAndKeywords (or its cousins),
* you have optional positional parameters, and
* you run out of positional arguments

CPython will call skipitem() to skip over the remaining positional parameters so it can process keyword arguments.  It does this by knowing all the format units, and iterating over them and throwing away the various varargs pointers until it hits the keyword arguments part of the format string.

Since nobody ever explained about the "w*" format unit to it, that means when it sees 'w*' it will misinterpret it.

In both 2.7 and 3.x, it'll interpret it as 'w', throw away one "char *" item from varargs, then the next thing that tries to parse a format unit (skipitem or convertsimple) will see the '*' and throw an 'impossible<bad format char>' exception.

(It's another bug that skipitem() supports 'w' and 'w#' in Python 3, but I filed that separately as #23926 .)

assignee: larry
components: Interpreter Core
messages: 240588
nosy: larry
priority: low
severity: normal
stage: test needed
status: open
title: getargs.c skipitem() doesn't skip 'w*'
type: crash
versions: Python 2.7, Python 3.4, Python 3.5

Python tracker <report at bugs.python.org>

More information about the New-bugs-announce mailing list