[issue33871] Possible integer overflow in iov_setup()

[Ned Deily]

Ned Deily <nad at python.org> added the comment:

Test case:

import os
fo = open('/tmp/temp', 'wb')
fi = open('/tmp/temp', 'rb')
os.sendfile(fo.fileno(), fi.fileno(), 0, 0, headers=[b'x' * 2**16] * 2**15)

--
run against current master HEAD (2f9cbaa8b2190b6dfd3157ede9b6973523a3b939, as of 2018-06-15)
--with-pydebug
current macOS 10.13.5


64-bit Python

$ ./bin/python3.8 ~/Desktop/test_s.py
Traceback (most recent call last):
 File "/Users/nad/Desktop/test_s.py", line 4, in <module>
   os.sendfile(fo.fileno(), fi.fileno(), 0, 0, headers=[b'x' * 2**16] * 2**15)
OSError: [Errno 38] Socket operation on non-socket
sys:1: ResourceWarning: unclosed file <_io.BufferedWriter name='/tmp/temp'>
sys:1: ResourceWarning: unclosed file <_io.BufferedReader name='/tmp/temp'>


32-bit Python

$ ./bin/python3.8-32 ~/Desktop/test_s.py
Fatal Python error: a function returned NULL without setting an error
SystemError: <built-in function sendfile> returned NULL without setting an error

Current thread 0xa983a1c0 (most recent call first):
 File "/Users/nad/Desktop/test_s.py", line 4 in <module>
Abort trap: 6

----------

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue33871>
_______________________________________