PT-2025-14373 · Crates.Io · Pyo3
Published
2025-04-01
·
Updated
2025-04-01
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
PyString::from object took &str arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the &str data and potentially leak contents of the out-of-bounds read (by raising a Python exception containing a copy of the data including the overflow).In PyO3 0.24.1 this function will now allocate a
CString to guarantee a terminating nul bytes. PyO3 0.25 will likely offer an alternative API which takes &CStr arguments. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pyo3