[security] bpo-13617: Reject embedded null characters in wchar* strings. (#2302)
Based on patch by Victor Stinner.
Add private C API function _PyUnicode_AsUnicode() which is similar to
PyUnicode_AsUnicode(), but checks for null characters.
diff --git a/Python/dynload_win.c b/Python/dynload_win.c
index 05050cf..0fdf77f 100644
--- a/Python/dynload_win.c
+++ b/Python/dynload_win.c
@@ -190,13 +190,13 @@
{
dl_funcptr p;
char funcname[258], *import_python;
- wchar_t *wpathname;
+ const wchar_t *wpathname;
#ifndef _DEBUG
_Py_CheckPython3();
#endif
- wpathname = PyUnicode_AsUnicode(pathname);
+ wpathname = _PyUnicode_AsUnicode(pathname);
if (wpathname == NULL)
return NULL;