gh-115886: Handle embedded null characters in shared memory name (GH-115887)

shm_open() and shm_unlink() now check for embedded null characters in
the name and raise an error instead of silently truncating it.

1 files changed, 13 insertions, 2 deletions

diff --git a/Modules/_multiprocessing/posixshmem.c b/Modules/_multiprocessing/posixshmem.c
index 425ce10..4ab15fa 100644
--- a/Modules/_multiprocessing/posixshmem.c
+++ b/Modules/_multiprocessing/posixshmem.c
@@ -11,6 +11,7 @@ posixshmem - A Python extension that provides shm_open() and shm_unlink()
 
 #include <Python.h>
 
+#include <string.h>               // strlen()
 #include <errno.h>                // EINTR
 #ifdef HAVE_SYS_MMAN_H
 #  include <sys/mman.h>           // shm_open(), shm_unlink()
@@ -48,10 +49,15 @@ _posixshmem_shm_open_impl(PyObject *module, PyObject *path, int flags,
 {
     int fd;
     int async_err = 0;
-    const char *name = PyUnicode_AsUTF8AndSize(path, NULL);
+    Py_ssize_t name_size;
+    const char *name = PyUnicode_AsUTF8AndSize(path, &name_size);
     if (name == NULL) {
         return -1;
     }
+    if (strlen(name) != (size_t)name_size) {
+        PyErr_SetString(PyExc_ValueError, "embedded null character");
+        return -1;
+    }
     do {
         Py_BEGIN_ALLOW_THREADS
         fd = shm_open(name, flags, mode);
@@ -87,10 +93,15 @@ _posixshmem_shm_unlink_impl(PyObject *module, PyObject *path)
 {
     int rv;
     int async_err = 0;
-    const char *name = PyUnicode_AsUTF8AndSize(path, NULL);
+    Py_ssize_t name_size;
+    const char *name = PyUnicode_AsUTF8AndSize(path, &name_size);
     if (name == NULL) {
         return NULL;
     }
+    if (strlen(name) != (size_t)name_size) {
+        PyErr_SetString(PyExc_ValueError, "embedded null character");
+        return NULL;
+    }
     do {
         Py_BEGIN_ALLOW_THREADS
         rv = shm_unlink(name);