Bug report

Bug description:

Discovered a buffer overflow vulnerability in the _Py_wreadlink function in Python's core codebase. This function, which reads the value of a symbolic link, fails to properly null-terminate the output buffer in certain edge cases, potentially leading to buffer overruns.

The function uses wcsncpy to copy a wide character string but doesn't guarantee null-termination:

wcsncpy(buf, wbuf, buflen);

Reproduction

The issue can be reproduced in any scenario where _Py_wreadlink is called with a symbolic link whose content length is exactly one less than the provided buffer size.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-136062: Buffer Overflow Vulnerability in _Py_wreadlink Function #136064