gh-156939: Detect buffer overflow in bytearray

Add bytearray_check_consistency() and
bytearray_check_trailing_null_byte() functions in call them in most
bytearray methods.

Author: vstinner

Include/cpython/bytearrayobject.h

@@ -7,7 +7,8 @@ typedef struct {
     PyObject_VAR_HEAD
     /* How many bytes allocated in ob_bytes
 
-       In the current implementation this is equivalent to Py_SIZE(ob_bytes_object).
+       In the current implementation this is equivalent to
+       PyBytes_GET_SIZE(ob_bytes_object).
        The value is always loaded and stored atomically for thread safety.
        There are API compatibilty concerns with removing so keeping for now. */
     Py_ssize_t ob_alloc;

Lib/test/test_capi/test_bytearray.py

@@ -1,6 +1,8 @@
 import sys
+import textwrap
 import unittest
 from test.support import import_helper
+from test.support.script_helper import assert_python_failure
 
 _testlimitedcapi = import_helper.import_module('_testlimitedcapi')
 from _testcapi import PY_SSIZE_T_MIN, PY_SSIZE_T_MAX
@@ -172,6 +174,28 @@ def test_resize(self):
         # CRASHES resize(object(), 0)
         # CRASHES resize(NULL, 0)
 
+    def test_detect_overflow(self):
+        # Test detection of buffer overflow
+        for operation in (
+            'repr(b)',
+            'b.resize(5)',
+            'del b[5:]',
+        ):
+            with self.subTest(operation):
+                code = textwrap.dedent(f'''
+                    from test.support import SuppressCrashReport
+                    import _testcapi
+
+                    with SuppressCrashReport():
+                        # Trigger a buffer overflow in a new bytearray
+                        b = _testcapi.bytearray_overflow(123)
+                        {operation}
+                        b = None
+                ''')
+                proc = assert_python_failure('-c', code)
+                self.assertIn(b'Buffer overflow detected in bytearray', proc.err)
+                self.assertIn(b'at position 123', proc.err)
+
 
 if __name__ == "__main__":
     unittest.main()

Misc/NEWS.d/next/Core_and_Builtins/2026-09-13-01-38-50.gh-issue-156939.rZjTzW.rst

@@ -0,0 +1,2 @@
+When Python is built in debug mode, :class:`bytearray` now detects buffer
+overflow. Patch by Victor Stinner.

Modules/_testcapi/bytes.c

@@ -502,13 +502,29 @@ test_byteswriter_ptr(PyObject *Py_UNUSED(module), PyObject *Py_UNUSED(args))
 }
 
 
+static PyObject *
+bytearray_overflow(PyObject *Py_UNUSED(module), PyObject *arg)
+{
+    PyObject *bytearray = PyObject_CallOneArg((PyObject*)&PyByteArray_Type, arg);
+    if (bytearray == NULL) {
+        return NULL;
+    }
+
+    char *data = PyByteArray_AS_STRING(bytearray);
+    Py_ssize_t size = PyByteArray_GET_SIZE(bytearray);
+    data[size] = '#';  // Buffer overflow!
+    return bytearray;
+}
+
+
 static PyMethodDef test_methods[] = {
     {"bytes_resize", bytes_resize, METH_VARARGS},
     {"bytes_join", bytes_join, METH_VARARGS},
     {"byteswriter_abc", byteswriter_abc, METH_NOARGS},
     {"byteswriter_resize", byteswriter_resize, METH_NOARGS},
     {"byteswriter_highlevel", byteswriter_highlevel, METH_NOARGS},
     {"test_byteswriter_ptr", test_byteswriter_ptr, METH_NOARGS},
+    {"bytearray_overflow", bytearray_overflow, METH_O},
     {NULL},
 };