From 7573d1a8fc8d40ebed2dcd8d716b3f82c1859dea Mon Sep 17 00:00:00 2001
From: JonthanaHanh <92574114+JonthanaHanh@users.noreply.github.com>
Date: Mon, 3 Aug 2026 22:21:11 +0700
Subject: [PATCH] fix(guard): catch ValueError from os.open on NUL-containing
 paths (#77780)

os.open() raises ValueError when the path contains an embedded NUL
byte, but _read_referenced_script only caught OSError. Add ValueError
to the except clause to prevent the guard from crashing.
---
 cron/lifecycle_guard.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/cron/lifecycle_guard.py b/cron/lifecycle_guard.py
index 6c7a5eaad062f..cf08e2a5d69f9 100644
--- a/cron/lifecycle_guard.py
+++ b/cron/lifecycle_guard.py
@@ -258,7 +258,10 @@ def _read_referenced_script(path: Path) -> tuple[Optional[str], bool]:
     flags = os.O_RDONLY | getattr(os, "O_NONBLOCK", 0)
     try:
         descriptor = os.open(path, flags)
-    except OSError:
+    except (OSError, ValueError):
+        # OSError: unreadable/long paths.  ValueError: embedded NUL byte
+        # in the path from binary content tokenized as a script path —
+        # a guarded path must never crash the guard (#76762, #77780).
         return None, False
     try:
         metadata = os.fstat(descriptor)