merge for issue #18556

Misc/NEWS

@@ -166,6 +166,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #18556: Check the return type of PyUnicode_AsWideChar() in ctype's
+  U_set().
+
 - Issue #17818: aifc.getparams now returns a namedtuple.
 
 - Issue #18549: Eliminate dead code in socket_ntohl()

Modules/_ctypes/cfield.c

@@ -1260,7 +1260,11 @@ U_set(void *ptr, PyObject *value, Py_ssize_t length)
     } else if (size < length-1)
         /* copy terminating NUL character if there is space */
         size += 1;
-    PyUnicode_AsWideChar(value, (wchar_t *)ptr, size);
+
+    if (PyUnicode_AsWideChar(value, (wchar_t *)ptr, size) == -1) {
+        return NULL;
+    }
+
     return value;
 }