The Python WeaselJsonParser class does not check the return value of WeaselJsonParser_create, so any stack size that causes the C constructor to return NULL leaves the wrapper holding a NULL parser pointer. Calling parse()/reset() on that wrapper immediately dereferences the null pointer and crashes the interpreter.
Affected file: weaseljson.py
Lines 114–120: self.p = self._lib.WeaselJsonParser_create(...) is stored without validation.
Lines 122–123: parse() uses self.p unchecked.
Line 125: reset() also uses self.p unchecked.
Lines 132–135: close() does check self.p is not None, but only after creation has already stored NULL.
Reproduction:
importweaseljsonclassR(weaseljson.WeaselJsonCallbacksBase):passparser=weaseljson.WeaselJsonParser(R(),stackSize=-1)# C API returns NULLparser.parse(b"{}")# segfault
Also crashes with stackSize=0, stackSize=1, or stackSize=2, because WeaselJsonParser_create rejects non-positive and too-small stacks (tested in src/test.cpp around the "create rejects too-small stack" case).
Expected behavior: WeaselJsonParser.__init__ should raise a clear Python exception (e.g. ValueError or MemoryError) when WeaselJsonParser_create returns NULL, instead of producing an object that segfaults on first use.
Actual behavior:
The interpreter segfaults.
The Python `WeaselJsonParser` class does not check the return value of `WeaselJsonParser_create`, so any stack size that causes the C constructor to return `NULL` leaves the wrapper holding a `NULL` parser pointer. Calling `parse()`/`reset()` on that wrapper immediately dereferences the null pointer and crashes the interpreter.
Affected file: `weaseljson.py`
- Lines 114–120: `self.p = self._lib.WeaselJsonParser_create(...)` is stored without validation.
- Lines 122–123: `parse()` uses `self.p` unchecked.
- Line 125: `reset()` also uses `self.p` unchecked.
- Lines 132–135: `close()` does check `self.p is not None`, but only after creation has already stored `NULL`.
Reproduction:
```python
import weaseljson
class R(weaseljson.WeaselJsonCallbacksBase):
pass
parser = weaseljson.WeaselJsonParser(R(), stackSize=-1) # C API returns NULL
parser.parse(b"{}") # segfault
```
Also crashes with `stackSize=0`, `stackSize=1`, or `stackSize=2`, because `WeaselJsonParser_create` rejects non-positive and too-small stacks (tested in `src/test.cpp` around the "create rejects too-small stack" case).
Expected behavior:
`WeaselJsonParser.__init__` should raise a clear Python exception (e.g. `ValueError` or `MemoryError`) when `WeaselJsonParser_create` returns `NULL`, instead of producing an object that segfaults on first use.
Actual behavior:
The interpreter segfaults.
weaselbot
was assigned by andrew2026-06-22 00:56:05 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The Python
WeaselJsonParserclass does not check the return value ofWeaselJsonParser_create, so any stack size that causes the C constructor to returnNULLleaves the wrapper holding aNULLparser pointer. Callingparse()/reset()on that wrapper immediately dereferences the null pointer and crashes the interpreter.Affected file:
weaseljson.pyself.p = self._lib.WeaselJsonParser_create(...)is stored without validation.parse()usesself.punchecked.reset()also usesself.punchecked.close()does checkself.p is not None, but only after creation has already storedNULL.Reproduction:
Also crashes with
stackSize=0,stackSize=1, orstackSize=2, becauseWeaselJsonParser_createrejects non-positive and too-small stacks (tested insrc/test.cpparound the "create rejects too-small stack" case).Expected behavior:
WeaselJsonParser.__init__should raise a clear Python exception (e.g.ValueErrororMemoryError) whenWeaselJsonParser_createreturnsNULL, instead of producing an object that segfaults on first use.Actual behavior:
The interpreter segfaults.