diff --git a/Misc/NEWS.d/next/Security/2025-06-28-08-24-06.gh-issue-136062.fXKonh.rst b/Misc/NEWS.d/next/Security/2025-06-28-08-24-06.gh-issue-136062.fXKonh.rst new file mode 100644 index 00000000000000..9275f949ea6dcf --- /dev/null +++ b/Misc/NEWS.d/next/Security/2025-06-28-08-24-06.gh-issue-136062.fXKonh.rst @@ -0,0 +1 @@ +Fix buffer overflow vulnerability in :func:`_Py_wreadlink` function by ensuring proper null-termination when using :c:func:`wcsncpy`. diff --git a/Python/fileutils.c b/Python/fileutils.c index 2a3f12d4e872f8..56c07c8e1b7721 100644 --- a/Python/fileutils.c +++ b/Python/fileutils.c @@ -2102,7 +2102,8 @@ _Py_wreadlink(const wchar_t *path, wchar_t *buf, size_t buflen) errno = EINVAL; return -1; } - wcsncpy(buf, wbuf, buflen); + wcsncpy(buf, wbuf, buflen - 1); + buf[buflen - 1] = L'\0'; /* Ensure null termination */ PyMem_RawFree(wbuf); return (int)r1; }