_Py_Mangle reads out of bounds for one-char identifiers

Bug description

_Py_Mangle() in Python/symtable.c calls PyUnicode_READ_CHAR(ident, 1) without first checking that ident has at least two characters. If ident is a one-character string (e.g. "_"), this reads one code point past the end of the unicode buffer.

The read is silent in release builds because a 1-char ASCII unicode object has enough padding for the null terminator, so ASAN does not trip. But it is still UB per the PyUnicode_READ_CHAR contract.

Reproducer

class C:
    _

Call path

_Py_Mangle entry check:

if (privateobj == NULL || !PyUnicode_Check(privateobj) ||
    PyUnicode_READ_CHAR(ident, 0) != '_' ||
    PyUnicode_READ_CHAR(ident, 1) != '_') {
    return Py_NewRef(ident);
}

For ident == "", READ_CHAR(ident, 0) != '' is false, so READ_CHAR(ident, 1) is evaluated — out of bounds.

Comparison

_Py_IsPrivateName() in the same file does guard with nlen < 3 before indexing. The guard is missing from _Py_Mangle().

Suggested fix

Add PyUnicode_GET_LENGTH(ident) < 2 || to the condition.

Linked PRs

gh-159164: Fix out-of-bounds read in _Py_Mangle for one-char identifiers #159165

pythongh-159164: Fix out-of-bounds read in _Py_Mangle for one-char id…

Sorry, but this isn't a bug. The docs for PyUnicode_READ_CHAR explicitly allow this:

CPython implementation detail: Accept reading the trailing null character at index PyUnicode_GetLength().

There's also a comment in PyUnicode_READ_CHAR that states this is allowed:

cpython/Include/cpython/unicodeobject.h

Lines 367 to 368 in e878e1e

    
           // Tolerate reading the NUL character at str[len(str)] 
        
           assert(index <= PyUnicode_GET_LENGTH(unicode));

The proposed fix is harmless, but it's unnecessary and encourages people to look for more cases like this.

In the future, please include sanitiser logs actually demonstrating the bug.

Navigation Menu

Repository navigation

_Py_Mangle reads out of bounds for one-char identifiers #159164

Bug description

Reproducer

Call path

Comparison

Suggested fix

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

	// Tolerate reading the NUL character at str[len(str)]
	assert(index <= PyUnicode_GET_LENGTH(unicode));

_Py_Mangle reads out of bounds for one-char identifiers #159164

Description

Bug description

Reproducer

Call path

Comparison

Suggested fix

Linked PRs

Activity

ZeroIntensity commented on Oct 11, 2026

StanFromIreland commented on Oct 11, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions