[pypy-svn] r67984 - in pypy/trunk/pypy: module/marshal/test objspace/std

[cfbolz at codespeak.net]

Author: cfbolz
Date: Tue Sep 29 16:52:46 2009
New Revision: 67984

Modified:
   pypy/trunk/pypy/module/marshal/test/test_marshalimpl.py
   pypy/trunk/pypy/objspace/std/marshal_impl.py
Log:
fix bug in marshaler that mutated a prebuilt 0l object


Modified: pypy/trunk/pypy/module/marshal/test/test_marshalimpl.py
==============================================================================
--- pypy/trunk/pypy/module/marshal/test/test_marshalimpl.py	(original)
+++ pypy/trunk/pypy/module/marshal/test/test_marshalimpl.py	Tue Sep 29 16:52:46 2009
@@ -37,3 +37,11 @@
         s = marshal.dumps(array.array('c', 'asd'))
         t = marshal.loads(s)
         assert type(t) is str and t == 'asd'
+
+    def test_unmarshal_evil_bool(self):
+        import marshal
+        raises(ValueError, marshal.loads, 'l\x02\x00\x00\x00\x00\x00\x00\x00')
+        z = marshal.loads('I\x00\xe4\x0bT\x02\x00\x00\x00')
+        assert z == 10000000000
+        z = marshal.loads('I\x00\x1c\xf4\xab\xfd\xff\xff\xff')
+        assert z == -10000000000

Modified: pypy/trunk/pypy/objspace/std/marshal_impl.py
==============================================================================
--- pypy/trunk/pypy/objspace/std/marshal_impl.py	(original)
+++ pypy/trunk/pypy/objspace/std/marshal_impl.py	Tue Sep 29 16:52:46 2009
@@ -270,7 +270,10 @@
         for i in range(lng):
             shift = i * SHIFT
             result = result.add(rbigint.fromint(u.get_short()).lshift(shift))
-        result.sign = sign
+        if lng and not result.tobool():
+            raise_exception(space, 'bad marshal data')
+        if sign == -1:
+            result = result.neg()
     else:
         digits = [0] * lng
         for i in range(lng):
@@ -278,6 +281,8 @@
             if digit < 0:
                 raise_exception(space, 'bad marshal data')
             digits[i] = digit
+        if digits[-1] == 0:
+            raise_exception(space, 'bad marshal data')
         result = rbigint(digits, sign)
     w_long = W_LongObject(result)
     return w_long