gh-145335: Fix crash when passing -1 as fd in os.pathconf by aisk · Pull Request #145390 · python/cpython

aisk · 2026-03-01T13:34:02Z

We currently test whether path_t.fd is -1 to decide if the argument should be treated as an fd or as a path, and then call fpathconf() or pathconf() according to it.

In the original issue, we passing -1 caused the code incorrectly treats the argument as a real path. But, path->narrow is NULL, so calling pathconf() on it will crash the interpreter.

This change adds a helper that checks whether the original argument is index-like to determine if it's an fd, so we can correctly the behavior and avoid the crash.

There are other os functions that accept path_t and may have the same issue. Since that is outside the scope of the original issue, I think we should fix those in a separate PR.

Issue: Segfault from running os.pathconf(-1, 1) #145335

picnixz · 2026-03-01T17:02:53Z

Modules/posixmodule.c

+static bool
+path_is_fd(const path_t *path)
+{
+    return path->allow_fd && path->object != NULL && PyIndex_Check(path->object);


Is the problem really with the check or with is it with the converter?

Instead of checking path->object type (PyIndex_Check()), I would prefer adding a path_t.is_fd member and modify path_converter() to set this member.

vstinner · 2026-03-02T14:45:34Z

Other functions have the same issues, even if they don't crash:

os.stat(-1)
os.statx(-1, mask=0)
os.chdir(-1)
os.chmod(-1, 0)
os.chown(-1, 0, 0)
os.listdir(-1): current it behaves as os.listdir(os.path.curdir)
os._path_exists(-1) (Windows only)
os._path_lexists(-1) (Windows only)
os._path_isdir(-1) (Windows only)
os._path_isfile(-1) (Windows only)
os._path_islink(-1) (Windows only)
os._path_isjunction(-1) (Windows only)
os.utime(-1, (0, 0))
os.execve(-1, ['/bin/true'], os.environ)
os.truncate(-1, 0)
os.statvfs(-1)
os.pathconf(-1, "PC_NAME_MAX") crash (issue Segfault from running os.pathconf(-1, 1) #145335)
os.getxattr(-1, "user")
os.setxattr(-1, "user", b"1")
os.removexattr(-1, "user")
os.listxattr(-1): current it behaves as os.listxattr(os.path.curdir)
os.scandir(-1): current it behaves as os.scandir(os.path.curdir)

On Linux (with the glibc), most functions fail with OSError: [Errno 14] Bad address: -1.

This list are functions using path_t(allow_fd=True) type in Argument Clinic, or variants such as path_t(allow_fd='PATH_HAVE_FCHDIR') type.

Lib/test/test_os/test_os.py

vstinner

LGTM

miss-islington-app · 2026-03-02T18:08:12Z

Thanks @aisk for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington-app · 2026-03-02T18:08:13Z

Thanks @aisk for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

…onGH-145390) (cherry picked from commit 5c3a47b) Co-authored-by: AN Long <aisk@users.noreply.github.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>

bedevere-app · 2026-03-02T18:08:25Z

GH-145432 is a backport of this pull request to the 3.13 branch.

bedevere-app · 2026-03-02T18:08:29Z

GH-145433 is a backport of this pull request to the 3.14 branch.

vstinner · 2026-03-02T18:12:19Z

Merged, thanks for your contribution @aisk.

I'm working on a fix for the other affected functions.

…145390) (#145432) gh-145335: Fix crash when passing -1 as fd in os.pathconf (GH-145390) (cherry picked from commit 5c3a47b) Co-authored-by: AN Long <aisk@users.noreply.github.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>

…145390) (#145433) gh-145335: Fix crash when passing -1 as fd in os.pathconf (GH-145390) (cherry picked from commit 5c3a47b) Co-authored-by: AN Long <aisk@users.noreply.github.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>

vstinner · 2026-03-02T19:39:50Z

I wrote #145439 to fix other os functions.

Fix crash when passing -1 as fd in os.pathconf

3c693cc

bedevere-app bot mentioned this pull request Mar 1, 2026

Segfault from running os.pathconf(-1, 1) #145335

Closed

bedevere-app bot added the awaiting review label Mar 1, 2026

📜🤖 Added by blurb_it.

bac84ce

picnixz reviewed Mar 1, 2026

View reviewed changes

vstinner reviewed Mar 2, 2026

View reviewed changes

Lib/test/test_os/test_os.py Outdated Show resolved Hide resolved

aisk added 2 commits March 3, 2026 01:38

Using is_fd field to determin a path_t is an fd or not

d0ed838

Fix skip messages

43334fa

vstinner approved these changes Mar 2, 2026

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting review labels Mar 2, 2026

vstinner merged commit 5c3a47b into python:main Mar 2, 2026
51 checks passed

bedevere-app bot removed the awaiting merge label Mar 2, 2026

vstinner added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Mar 2, 2026

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Mar 2, 2026

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Mar 2, 2026

Uh oh!

Conversation

aisk commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

picnixz Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

vstinner Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

aisk Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

vstinner commented Mar 2, 2026

Uh oh!

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington-app bot commented Mar 2, 2026

Uh oh!

miss-islington-app bot commented Mar 2, 2026

Uh oh!

bedevere-app bot commented Mar 2, 2026

Uh oh!

bedevere-app bot commented Mar 2, 2026

Uh oh!

vstinner commented Mar 2, 2026

Uh oh!

vstinner commented Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aisk commented Mar 1, 2026 •

edited

Loading