[Python-checkins] cpython (merge 3.4 -> default): Issue #23490: Fixed possible crashes related to interoperability between

[serhiy.storchaka]

https://hg.python.org/cpython/rev/56c6a4bce996
changeset:   94705:56c6a4bce996
parent:      94703:843a8ee94270
parent:      94704:038297948389
user:        Serhiy Storchaka <storchaka at gmail.com>
date:        Fri Feb 20 21:34:39 2015 +0200
summary:
  Issue #23490: Fixed possible crashes related to interoperability between
old-style and new API for string with 2**30-1 characters.

files:
  Objects/unicodeobject.c |  9 +++++++++
  1 files changed, 9 insertions(+), 0 deletions(-)


diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -1535,6 +1535,10 @@
         /* in case the native representation is 2-bytes, we need to allocate a
            new normalized 4-byte version. */
         length_wo_surrogates = _PyUnicode_WSTR_LENGTH(unicode) - num_surrogates;
+        if (length_wo_surrogates > PY_SSIZE_T_MAX / 4 - 1) {
+            PyErr_NoMemory();
+            return -1;
+        }
         _PyUnicode_DATA_ANY(unicode) = PyObject_MALLOC(4 * (length_wo_surrogates + 1));
         if (!_PyUnicode_DATA_ANY(unicode)) {
             PyErr_NoMemory();
@@ -3811,6 +3815,11 @@
 #endif
         }
         else {
+            if ((size_t)_PyUnicode_LENGTH(unicode) >
+                    PY_SSIZE_T_MAX / sizeof(wchar_t) - 1) {
+                PyErr_NoMemory();
+                return NULL;
+            }
             _PyUnicode_WSTR(unicode) = (wchar_t *) PyObject_MALLOC(sizeof(wchar_t) *
                                                   (_PyUnicode_LENGTH(unicode) + 1));
             if (!_PyUnicode_WSTR(unicode)) {

-- 
Repository URL: https://hg.python.org/cpython