[pypy-commit] pypy py3.3: CPython Issue #18025: Fixed a segfault in io.BufferedIOBase.readinto() when raw

[amauryfa]

Author: Amaury Forgeot d'Arc <amauryfa at gmail.com>
Branch: py3.3
Changeset: r75250:4eebc41245ad
Date: 2015-01-05 23:45 +0100
http://bitbucket.org/pypy/pypy/changeset/4eebc41245ad/

Log:	CPython Issue #18025: Fixed a segfault in
	io.BufferedIOBase.readinto() when raw stream's read() returns more
	bytes than requested.

diff --git a/pypy/module/_io/interp_bufferedio.py b/pypy/module/_io/interp_bufferedio.py
--- a/pypy/module/_io/interp_bufferedio.py
+++ b/pypy/module/_io/interp_bufferedio.py
@@ -77,6 +77,11 @@
             raise OperationError(space.w_TypeError, space.wrap(
                 "read() should return bytes"))
         data = space.bytes_w(w_data)
+        if len(data) > length:
+            raise oefmt(space.w_ValueError,
+                        "read() returned too much data: "
+                        "%d bytes requested, %d returned",
+                        length, len(data))
         rwbuffer.setslice(0, data)
         return space.wrap(len(data))
 
diff --git a/pypy/module/_io/test/test_bufferedio.py b/pypy/module/_io/test/test_bufferedio.py
--- a/pypy/module/_io/test/test_bufferedio.py
+++ b/pypy/module/_io/test/test_bufferedio.py
@@ -149,6 +149,15 @@
         f.close()
         assert a == b'a\nb\ncxxxxx'
 
+    def test_readinto_buffer_overflow(self):
+        import _io
+        class BadReader(_io._BufferedIOBase):
+            def read(self, n=-1):
+                return b'x' * 10**6
+        bufio = BadReader()
+        b = bytearray(2)
+        raises(ValueError, bufio.readinto, b)
+
     def test_seek(self):
         import _io
         raw = _io.FileIO(self.tmpfile)