Skip to content

Conversation

@Dr-Emann
Copy link
Contributor

fixes #5005

This only fixes the API, and adds a test of the API, it does not deprecate the API or introduce a version which takes &CStr directly, this can be done later.

fixes PyO3#5005

This only fixes the API, and adds a test of the API, it does not
deprecate the API or introduce a version which takes `&CStr` directly,
this can be done later.
Copy link
Member

@davidhewitt davidhewitt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@davidhewitt davidhewitt added this pull request to the merge queue Mar 28, 2025
Merged via the queue into PyO3:main with commit 5caaa37 Mar 28, 2025
48 checks passed
@Wumpf
Copy link

Wumpf commented Apr 1, 2025

@davidhewitt thank you so much for releasing this so timely in a patch release! Do you plan on backporting this to the 0.23.x line as well? I'd like to update to 0.24.x but we also depend on arrow-rs which only recently moved their main branch to 0.24, so stuck on 0.23.x for the moment.

@mejrs
Copy link
Member

mejrs commented Apr 1, 2025

@davidhewitt thank you so much for releasing this so timely in a patch release! Do you plan on backporting this to the 0.23.x line as well? I'd like to update to 0.24.x but we also depend on arrow-rs which only recently moved their main branch to 0.24, so stuck on 0.23.x for the moment.

I don't see why not, but note that you can safely use this api if you take care to null terminate the string yourself, like "utf-8\0".

@davidhewitt
Copy link
Member

As per #5005 (comment), I was not planning to backport. I suspect that almost nobody was using this API, hence why it was broken for so long, so I think the ecosystem risk is low.

peterhj pushed a commit to peterhj/pyo3 that referenced this pull request May 20, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PyString::from_object does not convert rust strings to c-strings before calling FFI, causing OOB reads

5 participants