Repository navigation
bytes.fromhex() reads uninitialized memory #158583
Description
Example:
import array
res = bytes.fromhex(array.array('B', b' 1A 2B 30 '))
try:
bytes.fromhex(array.array('B', b' 1A 2B 3'))
except ValueError:
passValgrind reports two "Use of uninitialised value of size 8" errors:
$ PYTHONMALLOC=malloc valgrind ./python x.py
==863634== Memcheck, a memory error detector
==863634== Copyright (C) 2002-2026, and GNU GPL'd, by Julian Seward et al.
==863634== Using Valgrind-3.27.1 and LibVEX; rerun with -h for copyright info
==863634== Command: ./python x.py
==863634==
==863634== Use of uninitialised value of size 8
==863634== at 0x497C07: _PyBytes_FromHex (bytesobject.c:2688)
==863634== by 0x497CC2: bytes_fromhex_impl (bytesobject.c:2618)
==863634== by 0x497D07: bytes_fromhex (bytesobject.c.h:1261)
==863634== by 0x4F491A: cfunction_vectorcall_O (methodobject.c:535)
==863634== by 0x49BDAF: _PyObject_VectorcallTstate (pycore_call.h:149)
==863634== by 0x49BE77: PyObject_Vectorcall (call.c:327)
==863634== by 0x5B0C90: _Py_VectorCallInstrumentation_StackRefSteal (ceval.c:770)
==863634== by 0x5B7E1C: _PyEval_EvalFrameDefault (generated_cases.c.h:1906)
==863634== by 0x5CFACD: _PyEval_EvalFrame (pycore_ceval.h:122)
==863634== by 0x5CFC98: _PyEval_Vector (ceval.c:2176)
==863634== by 0x5CFD7C: PyEval_EvalCode (ceval.c:681)
==863634== by 0x649C6B: run_eval_code_obj (pythonrun.c:1406)
==863634==
==863634== Use of uninitialised value of size 8
==863634== at 0x497BC1: _PyBytes_FromHex (bytesobject.c:2700)
==863634== by 0x497CC2: bytes_fromhex_impl (bytesobject.c:2618)
==863634== by 0x497D07: bytes_fromhex (bytesobject.c.h:1261)
==863634== by 0x4F491A: cfunction_vectorcall_O (methodobject.c:535)
==863634== by 0x49BDAF: _PyObject_VectorcallTstate (pycore_call.h:149)
==863634== by 0x49BE77: PyObject_Vectorcall (call.c:327)
==863634== by 0x5B0C90: _Py_VectorCallInstrumentation_StackRefSteal (ceval.c:770)
==863634== by 0x5B7E1C: _PyEval_EvalFrameDefault (generated_cases.c.h:1906)
==863634== by 0x5CFACD: _PyEval_EvalFrame (pycore_ceval.h:122)
==863634== by 0x5CFC98: _PyEval_Vector (ceval.c:2176)
==863634== by 0x5CFD7C: PyEval_EvalCode (ceval.c:681)
==863634== by 0x649C6B: run_eval_code_obj (pythonrun.c:1406)
==863634==
==863634==
==863634== HEAP SUMMARY:
==863634== in use at exit: 1,618 bytes in 4 blocks
==863634== total heap usage: 36,249 allocs, 36,245 frees, 9,219,652 bytes allocated
==863634==
==863634== LEAK SUMMARY:
==863634== definitely lost: 0 bytes in 0 blocks
==863634== indirectly lost: 0 bytes in 0 blocks
==863634== possibly lost: 0 bytes in 0 blocks
==863634== still reachable: 1,618 bytes in 4 blocks
==863634== suppressed: 0 bytes in 0 blocks
==863634== Rerun with --leak-check=full to see details of leaked memory
==863634==
==863634== Use --track-origins=yes to see where uninitialised values come from
==863634== For lists of detected and suppressed errors, rerun with: -s
==863634== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)
The problem is in _PyBytes_FromHex(): str++ doesn't check if we reached end.
For example, for a buffer of 10 bytes, it can read the 11th: outside the buffer!
Activity
pythongh-158583: Fix uninitialized memory read in bytes.fromhex()
vstinner commentedon Oct 1, 2026
bytes.fromhex() and bytearray.fromhex() was modified by commit e0637ce in Python 3.14 to accept more types, Python 3.13 only accepts str.
gh-158583: Fix uninitialized memory read in bytes.fromhex() (#158584)
[3.14] gh-158583: Fix uninitialized memory read in bytes.fromhex() (G…
[3.15] gh-158583: Fix uninitialized memory read in bytes.fromhex() (G…
Revert "[3.15] pythongh-158583: Fix uninitialized memory read in byte…
[3.15] Restore deferred backports for 3.15.1, including GH-158874 (#1…