[New-bugs-announce] [issue10133] conn_recv_string() broken error handling

[Hallvard B Furuseth]

New submission from Hallvard B Furuseth <h.b.furuseth at usit.uio.no>:

Neither conn_recv_string() nor its callers free *newbuffer on error.

The promotion rules break negative 'res' for 64-bit Py_ssize_t
in the (ulength <= buflength) branch:
res = -1 ==> (UINT32)-1 ==> Py_ssize_t 0xffffffff instead of -1.

While I'm writing: The _conn_recvall() calls can be factored out
of the if().

This patch applies to both 3.2a3 and 2.7.  However, the patched failure
cases are untested: I do not know how to test them. It passes make test.

----------
components: IO
files: conn_recv_string_failures.diff
keywords: patch
messages: 118978
nosy: hfuru
priority: normal
severity: normal
status: open
title: conn_recv_string() broken error handling
type: behavior
versions: Python 3.2
Added file: http://bugs.python.org/file19256/conn_recv_string_failures.diff

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue10133>
_______________________________________