readline is missing a null pointer check on strdup return value

Bug report

Bug description:

In readline.c, a call is made to strdup to populate completer_word_break_characters, but the return value of strdup is never checked before being used. In strdup failed, it will lead to a hard crash.

cpython/Modules/readline.c

Lines 1404 to 1416 in 1d28f9a

    
               completer_word_break_characters = 
        
                   strdup(" \t\n`~!@#$%^&*()-=+[{]}\\|;:'\",<>/?"); 
        
                   /* All nonalphanums except '.' */ 
        
           #ifdef WITH_EDITLINE 
        
               // libedit uses rl_basic_word_break_characters instead of 
        
               // rl_completer_word_break_characters as complete delimiter 
        
               rl_basic_word_break_characters = completer_word_break_characters; 
        
           #else 
        
               if (using_libedit_emulation) { 
        
                   rl_basic_word_break_characters = completer_word_break_characters; 
        
               } 
        
           #endif 
        
               rl_completer_word_break_characters = completer_word_break_characters;

CPython versions tested on:

CPython main branch

Operating systems tested on:

macOS

Linked PRs

Could you please check whether we should backport this fix?

@sergey-miryanov

Could you please check whether we should backport this fix?

@sergey-miryanov I do believe this needs to be backported, it's in the same state on 3.15 / 3.14 / 3.13. If you consider it security and not a bug fix then probably even to older versions as well.

Thanks! I'm not sure this should be classified as a security bug.

We usually don't treat bugs related to memory allocation failures as security bugs. But it's worth it to backport the bugfix up to 3.13 branch.

gh-150372: Add missing null check on completer_word_break_characters …

[3.13] gh-150372: Add missing null check on completer_word_break_char…

[3.14] gh-150372: Add missing null check on completer_word_break_char…

[3.15] gh-150372: Add missing null check on completer_word_break_char…

Navigation Menu

Repository navigation

`readline` is missing a null pointer check on `strdup` return value #150372

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

	completer_word_break_characters =
	strdup(" \t\n`~!@#$%^&*()-=+[{]}\\\|;:'\",<>/?");
	/* All nonalphanums except '.' */
	#ifdef WITH_EDITLINE
	// libedit uses rl_basic_word_break_characters instead of
	// rl_completer_word_break_characters as complete delimiter
	rl_basic_word_break_characters = completer_word_break_characters;
	#else
	if (using_libedit_emulation) {
	rl_basic_word_break_characters = completer_word_break_characters;
	}
	#endif
	rl_completer_word_break_characters = completer_word_break_characters;

readline is missing a null pointer check on strdup return value #150372

Description

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Activity

sergey-miryanov commented on May 25, 2026

KowalskiThomas commented on May 25, 2026

sergey-miryanov commented on May 25, 2026

vstinner commented on May 28, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions

`readline` is missing a null pointer check on `strdup` return value #150372