Bug#1141267: python3-apt: apt_pkg.config.value_list() segfaults on non-ASCII bytes in apt config

Package: python3-apt
Version: 3.0.0
Severity: important
Tags: upstream
X-Debbugs-Cc: [email protected]

Dear Maintainer,

apt_pkg.config.value_list() segfaults when an apt configuration list
contains a non-ASCII byte.

Minimal reproducer:

import apt_pkg
import tempfile

apt_pkg.init_config()

with tempfile.NamedTemporaryFile("wb", delete=3DFalse) as f:
    f.write(b'Test {\x80};\n')
    p =3D f.name

apt_pkg.read_config_file(apt_pkg.config, p)
apt_pkg.config.value_list(=E2=80=9CTest")

Actual result:

  Segmentation fault inside apt_pkg.cpython-313-aarch64-linux-gnu.so

Expected result:

  The malformed configuration should be rejected with an exception or
  parse error instead of crashing the Python interpreter.

I originally hit this through unattended-upgrades after an invalid byte
was accidentally inserted in /etc/apt/apt.conf.d/50unattended-upgrades.
I reduced it to the python3-apt reproducer above.

This appears related to #995118, but affects
apt_pkg.config.value_list() rather than apt_pkg.TagSection.keys().

I also reproduced the issue on x86, so it does not appear to be
arm64-specific.


-- System Information:
Debian Release: 13.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, =
'stable')
Architecture: arm64 (aarch64)

Kernel: Linux 6.12.76-linuxkit (SMP w/12 CPU threads)
Kernel taint flags: TAINT_OOT_MODULE
Locale: LANG=3DC, LC_CTYPE=3DC.UTF-8 (charmap=3DUTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: unable to detect

Versions of packages python3-apt depends on:
ii  distro-info-data   0.66+deb13u2
ii  libapt-pkg7.0      3.0.3
ii  libc6              2.41-12+deb13u3
ii  libgcc-s1          14.2.0-19
ii  libstdc++6         14.2.0-19
ii  python-apt-common  3.0.0
ii  python3            3.13.5-1

Versions of packages python3-apt recommends:
ii  iso-codes    4.18.0-1
ii  lsb-release  12.1-1

Versions of packages python3-apt suggests:
ii  apt             3.0.3
pn  python-apt-doc  <none>

-- no debconf information