[Python-checkins] cpython (merge 3.3 -> default): Issue #17919: Fixed integer overflow in the eventmask parameter.

[serhiy.storchaka]

http://hg.python.org/cpython/rev/2fbb3c77f157
changeset:   87955:2fbb3c77f157
parent:      87952:561822250761
parent:      87954:87bbe810e4e7
user:        Serhiy Storchaka <storchaka at gmail.com>
date:        Sat Dec 14 19:18:39 2013 +0200
summary:
  Issue #17919: Fixed integer overflow in the eventmask parameter.

files:
  Lib/test/test_devpoll.py |  11 +++++++
  Lib/test/test_poll.py    |  13 +++++---
  Misc/NEWS                |   3 +-
  Modules/selectmodule.c   |  40 ++++++++++++++++++++-------
  4 files changed, 50 insertions(+), 17 deletions(-)


diff --git a/Lib/test/test_devpoll.py b/Lib/test/test_devpoll.py
--- a/Lib/test/test_devpoll.py
+++ b/Lib/test/test_devpoll.py
@@ -121,6 +121,17 @@
         self.assertEqual(os.get_inheritable(devpoll.fileno()), False)
 
 
+    def test_events_mask_overflow(self):
+        pollster = select.devpoll()
+        w, r = os.pipe()
+        pollster.register(w)
+        # Issue #17919
+        self.assertRaises(OverflowError, pollster.register, 0, -1)
+        self.assertRaises(OverflowError, pollster.register, 0, USHRT_MAX + 1)
+        self.assertRaises(OverflowError, pollster.modify, 1, -1)
+        self.assertRaises(OverflowError, pollster.modify, 1, USHRT_MAX + 1)
+
+
 def test_main():
     run_unittest(DevPollTests)
 
diff --git a/Lib/test/test_poll.py b/Lib/test/test_poll.py
--- a/Lib/test/test_poll.py
+++ b/Lib/test/test_poll.py
@@ -4,7 +4,7 @@
 import subprocess
 import random
 import select
-import _testcapi
+from _testcapi import USHRT_MAX, INT_MAX, UINT_MAX
 try:
     import threading
 except ImportError:
@@ -161,10 +161,13 @@
         if x != 5:
             self.fail('Overflow must have occurred')
 
-        pollster = select.poll()
-        # Issue 15989
-        self.assertRaises(OverflowError, pollster.poll, _testcapi.INT_MAX + 1)
-        self.assertRaises(OverflowError, pollster.poll, _testcapi.UINT_MAX + 1)
+        # Issues #15989, #17919
+        self.assertRaises(OverflowError, pollster.register, 0, -1)
+        self.assertRaises(OverflowError, pollster.register, 0, USHRT_MAX + 1)
+        self.assertRaises(OverflowError, pollster.modify, 1, -1)
+        self.assertRaises(OverflowError, pollster.modify, 1, USHRT_MAX + 1)
+        self.assertRaises(OverflowError, pollster.poll, INT_MAX + 1)
+        self.assertRaises(OverflowError, pollster.poll, UINT_MAX + 1)
 
     @unittest.skipUnless(threading, 'Threading required for this test.')
     @reap_threads
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -47,7 +47,8 @@
 - Issue #19946: multiprocessing.spawn now raises ImportError when the module to
   be used as the main module cannot be imported.
 
-- Issue #17919: select.poll.poll() again works with poll.POLLNVAL on AIX.
+- Issue #17919: select.poll.register() again works with poll.POLLNVAL on AIX.
+  Fixed integer overflow in the eventmask parameter.
 
 - Issue #19063: if a Charset's body_encoding was set to None, the email
   package would generate a message claiming the Content-Transfer-Encoding
diff --git a/Modules/selectmodule.c b/Modules/selectmodule.c
--- a/Modules/selectmodule.c
+++ b/Modules/selectmodule.c
@@ -356,7 +356,7 @@
         assert(i < self->ufd_len);
         /* Never overflow */
         self->ufds[i].fd = (int)PyLong_AsLong(key);
-        self->ufds[i].events = (short)PyLong_AsLong(value);
+        self->ufds[i].events = (short)(unsigned short)PyLong_AsLong(value);
         i++;
     }
     assert(i == self->ufd_len);
@@ -364,6 +364,24 @@
     return 1;
 }
 
+static int
+ushort_converter(PyObject *obj, void *ptr)
+{
+    unsigned long uval;
+
+    uval = PyLong_AsUnsignedLong(obj);
+    if (uval == (unsigned long)-1 && PyErr_Occurred())
+        return 0;
+    if (uval > USHRT_MAX) {
+        PyErr_SetString(PyExc_OverflowError,
+                        "Python int too large for C unsigned short");
+        return 0;
+    }
+
+    *(unsigned short *)ptr = Py_SAFE_DOWNCAST(uval, unsigned long, unsigned short);
+    return 1;
+}
+
 PyDoc_STRVAR(poll_register_doc,
 "register(fd [, eventmask] ) -> None\n\n\
 Register a file descriptor with the polling object.\n\
@@ -375,12 +393,12 @@
 poll_register(pollObject *self, PyObject *args)
 {
     PyObject *o, *key, *value;
-    int fd, events = POLLIN | POLLPRI | POLLOUT;
+    int fd;
+    unsigned short events = POLLIN | POLLPRI | POLLOUT;
     int err;
 
-    if (!PyArg_ParseTuple(args, "O|i:register", &o, &events)) {
+    if (!PyArg_ParseTuple(args, "O|O&:register", &o, ushort_converter, &events))
         return NULL;
-    }
 
     fd = PyObject_AsFileDescriptor(o);
     if (fd == -1) return NULL;
@@ -418,12 +436,12 @@
 poll_modify(pollObject *self, PyObject *args)
 {
     PyObject *o, *key, *value;
-    int fd, events;
+    int fd;
+    unsigned short events;
     int err;
 
-    if (!PyArg_ParseTuple(args, "Oi:modify", &o, &events)) {
+    if (!PyArg_ParseTuple(args, "OO&:modify", &o, ushort_converter, &events))
         return NULL;
-    }
 
     fd = PyObject_AsFileDescriptor(o);
     if (fd == -1) return NULL;
@@ -728,14 +746,14 @@
 internal_devpoll_register(devpollObject *self, PyObject *args, int remove)
 {
     PyObject *o;
-    int fd, events = POLLIN | POLLPRI | POLLOUT;
+    int fd;
+    unsigned short events = POLLIN | POLLPRI | POLLOUT;
 
     if (self->fd_devpoll < 0)
         return devpoll_err_closed();
 
-    if (!PyArg_ParseTuple(args, "O|i:register", &o, &events)) {
+    if (!PyArg_ParseTuple(args, "O|O&:register", &o, ushort_converter, &events))
         return NULL;
-    }
 
     fd = PyObject_AsFileDescriptor(o);
     if (fd == -1) return NULL;
@@ -751,7 +769,7 @@
     }
 
     self->fds[self->n_fds].fd = fd;
-    self->fds[self->n_fds].events = events;
+    self->fds[self->n_fds].events = (signed short)events;
 
     if (++self->n_fds == self->max_n_fds) {
         if (devpoll_flush(self))

-- 
Repository URL: http://hg.python.org/cpython