[3.11] gh-160898: Reject null bytes in socket.getaddrinfo() host and port (GH-160899)

(cherry picked from commit 131a3a6)
(cherry picked from commit ee60d5d)
(cherry picked from commit 589379e)

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Stan Ulbrych <stan@python.org>

Author: sethmlarson

Doc/library/socket.rst

@@ -859,6 +859,9 @@ The :mod:`socket` module also offers various network-related services:
       for IPv6 multicast addresses, string representing an address will not
       contain ``%scope_id`` part.
 
+   .. versionchanged:: next
+      Null characters are now rejected in the *host* and *port* parameters.
+
 .. function:: getfqdn([name])
 
    Return a fully qualified domain name for *name*. If *name* is omitted or empty,

Lib/test/test_socket.py

@@ -1859,6 +1859,39 @@ def test_getnameinfo_ipv6_scopeid_numeric(self):
         nameinfo = socket.getnameinfo(sockaddr, socket.NI_NUMERICHOST | socket.NI_NUMERICSERV)
         self.assertEqual(nameinfo, ('ff02::1de:c0:face:8d%' + str(ifindex), '1234'))
 
+    def test_getaddrinfo_null_bytes(self):
+        # getaddrinfo() must reject embedded null bytes instead of silently
+        # truncating the host or port at the C boundary.  The checks run
+        # before any name resolution, so no network access is needed.
+        hosts = [
+            # embedded
+            'local\0host', b'local\0host',
+            # trailing
+            'localhost\0', b'localhost\0',
+            # leading (truncates to '')
+            '\0localhost', b'\0localhost',
+            '\0', b'\0',
+            # non-ASCII, goes through IDNA
+            'b\xfccher\0.example',
+        ]
+        for host in hosts:
+            with self.subTest(host=host):
+                with self.assertRaisesRegex(ValueError, 'host'):
+                    socket.getaddrinfo(host, 80)
+
+        ports = [
+            '8\x000',
+            b'8\x000',
+            'http\0',
+            b'http\0',
+            '\0',
+            b'\0'
+        ]
+        for port in ports:
+            with self.subTest(port=port):
+                with self.assertRaisesRegex(ValueError, 'port'):
+                    socket.getaddrinfo("localhost", port)
+
     def test_str_for_enums(self):
         # Make sure that the AF_* and SOCK_* constants have enum-like string
         # reprs.

Misc/NEWS.d/next/Security/2026-10-27-16-25-40.gh-issue-160898.epi53X.rst

@@ -0,0 +1,4 @@
+.. cve: CVE-2026-116566
+
+:func:`socket.getaddrinfo` now rejects null bytes within *host* and *port*
+parameters as this previously caused the values to be silently truncated.

Modules/socketmodule.c

@@ -6557,8 +6557,9 @@ socket_getaddrinfo(PyObject *self, PyObject *args, PyObject* kwargs)
     struct addrinfo *res0 = NULL;
     PyObject *hobj = NULL;
     PyObject *pobj = (PyObject *)NULL;
-    char pbuf[30];
+    PyObject *pstr = NULL;
     const char *hptr, *pptr;
+    Py_ssize_t hlen = 0, plen = 0;
     int family, socktype, protocol, flags;
     int error;
     PyObject *all = (PyObject *)NULL;
@@ -6579,31 +6580,46 @@ socket_getaddrinfo(PyObject *self, PyObject *args, PyObject* kwargs)
             return NULL;
         assert(PyBytes_Check(idna));
         hptr = PyBytes_AS_STRING(idna);
+        hlen = PyBytes_GET_SIZE(idna);
     } else if (PyBytes_Check(hobj)) {
-        hptr = PyBytes_AsString(hobj);
+        hptr = PyBytes_AS_STRING(hobj);
+        hlen = PyBytes_GET_SIZE(hobj);
     } else {
         PyErr_SetString(PyExc_TypeError,
                         "getaddrinfo() argument 1 must be string or None");
         return NULL;
     }
+    if (hptr != NULL && strlen(hptr) != (size_t)hlen) {
+        PyErr_SetString(PyExc_ValueError,
+                        "getaddrinfo() host must not contain null characters");
+        goto err;
+    }
     if (PyLong_CheckExact(pobj)) {
-        long value = PyLong_AsLong(pobj);
-        if (value == -1 && PyErr_Occurred())
+        pstr = PyObject_Str(pobj);
+        if (pstr == NULL)
+            goto err;
+        assert(PyUnicode_Check(pstr));
+        pptr = PyUnicode_AsUTF8AndSize(pstr, &plen);
+        if (pptr == NULL)
             goto err;
-        PyOS_snprintf(pbuf, sizeof(pbuf), "%ld", value);
-        pptr = pbuf;
     } else if (PyUnicode_Check(pobj)) {
-        pptr = PyUnicode_AsUTF8(pobj);
+        pptr = PyUnicode_AsUTF8AndSize(pobj, &plen);
         if (pptr == NULL)
             goto err;
     } else if (PyBytes_Check(pobj)) {
         pptr = PyBytes_AS_STRING(pobj);
+        plen = PyBytes_GET_SIZE(pobj);
     } else if (pobj == Py_None) {
         pptr = (char *)NULL;
     } else {
         PyErr_SetString(PyExc_OSError, "Int or String expected");
         goto err;
     }
+    if (pptr != NULL && strlen(pptr) != (size_t)plen) {
+        PyErr_SetString(PyExc_ValueError,
+                        "getaddrinfo() port must not contain null characters");
+        goto err;
+    }
 #if defined(__APPLE__) && defined(AI_NUMERICSERV)
     if ((flags & AI_NUMERICSERV) && (pptr == NULL || (pptr[0] == '0' && pptr[1] == 0))) {
         /* On OSX up to at least OSX 10.8 getaddrinfo crashes