[Python-checkins] python/dist/src/PC _winreg.c,1.14,1.15

[gvanrossum at users.sourceforge.net]

Update of /cvsroot/python/python/dist/src/PC
In directory sc8-pr-cvs1:/tmp/cvs-serv9905

Modified Files:
	_winreg.c 
Log Message:
Remove all uses of alloca() from this module.  The alloca() return value
isn't checked, and it *is* possible that a very large alloca() call is
made, e.g. when a large registry value is being read.  I don't know if
alloca() in that case returns NULL or returns a pointer pointing outside
the stack, and I don't want to know -- I've simply replaced all calls to
alloca() with either PyMem_Malloc() or PyString_FromStringAndSize(NULL,)
as appropriate, followed by a size check.  This addresses SF buf 851056.
Will backport to 2.3 next.


Index: _winreg.c
===================================================================
RCS file: /cvsroot/python/python/dist/src/PC/_winreg.c,v
retrieving revision 1.14
retrieving revision 1.15
diff -C2 -d -r1.14 -r1.15
*** _winreg.c	15 Jan 2003 23:38:15 -0000	1.14
--- _winreg.c	30 Nov 2003 22:01:43 -0000	1.15
***************
*** 1032,1035 ****
--- 1032,1036 ----
  	int index;
  	long rc;
+ 	PyObject *retStr;
  	char *retBuf;
  	DWORD len;
***************
*** 1046,1054 ****
  							   "RegQueryInfoKey");
  	++len;    /* include null terminator */
! 	retBuf = (char *)alloca(len);
  
! 	if ((rc = RegEnumKey(hKey, index, retBuf, len)) != ERROR_SUCCESS)
  		return PyErr_SetFromWindowsErrWithFunction(rc, "RegEnumKey");
! 	return Py_BuildValue("s", retBuf);
  }
  
--- 1047,1061 ----
  							   "RegQueryInfoKey");
  	++len;    /* include null terminator */
! 	retStr = PyString_FromStringAndSize(NULL, len);
! 	if (retStr == NULL)
! 		return NULL;
! 	retBuf = PyString_AS_STRING(retStr);
  
! 	if ((rc = RegEnumKey(hKey, index, retBuf, len)) != ERROR_SUCCESS) {
! 		Py_DECREF(retStr);
  		return PyErr_SetFromWindowsErrWithFunction(rc, "RegEnumKey");
! 	}
! 	_PyString_Resize(&retStr, strlen(retBuf));
! 	return retStr;
  }
  
***************
*** 1081,1086 ****
  	++retValueSize;    /* include null terminators */
  	++retDataSize;
! 	retValueBuf = (char *)alloca(retValueSize);
! 	retDataBuf = (char *)alloca(retDataSize);
  
  	Py_BEGIN_ALLOW_THREADS
--- 1088,1099 ----
  	++retValueSize;    /* include null terminators */
  	++retDataSize;
! 	retValueBuf = (char *)PyMem_Malloc(retValueSize);
! 	if (retValueBuf == NULL)
! 		return PyErr_NoMemory();
! 	retDataBuf = (char *)PyMem_Malloc(retDataSize);
! 	if (retDataBuf == NULL) {
! 		PyMem_Free(retValueBuf);
! 		return PyErr_NoMemory();
! 	}
  
  	Py_BEGIN_ALLOW_THREADS
***************
*** 1095,1106 ****
  	Py_END_ALLOW_THREADS
  
! 	if (rc != ERROR_SUCCESS)
! 		return PyErr_SetFromWindowsErrWithFunction(rc,
! 							   "PyRegEnumValue");
  	obData = Reg2Py(retDataBuf, retDataSize, typ);
! 	if (obData == NULL)
! 		return NULL;
  	retVal = Py_BuildValue("sOi", retValueBuf, obData, typ);
  	Py_DECREF(obData);
  	return retVal;
  }
--- 1108,1126 ----
  	Py_END_ALLOW_THREADS
  
! 	if (rc != ERROR_SUCCESS) {
! 		retVal = PyErr_SetFromWindowsErrWithFunction(rc,
! 							     "PyRegEnumValue");
! 		goto fail;
! 	}
  	obData = Reg2Py(retDataBuf, retDataSize, typ);
! 	if (obData == NULL) {
! 		retVal = NULL;
! 		goto fail;
! 	}
  	retVal = Py_BuildValue("sOi", retValueBuf, obData, typ);
  	Py_DECREF(obData);
+   fail:
+ 	PyMem_Free(retValueBuf);
+ 	PyMem_Free(retDataBuf);
  	return retVal;
  }
***************
*** 1207,1214 ****
  	PyObject *obKey;
  	char *subKey;
- 
  	long rc;
  	char *retBuf;
  	long bufSize = 0;
  	if (!PyArg_ParseTuple(args, "Oz:QueryValue", &obKey, &subKey))
  		return NULL;
--- 1227,1235 ----
  	PyObject *obKey;
  	char *subKey;
  	long rc;
+ 	PyObject *retStr;
  	char *retBuf;
  	long bufSize = 0;
+ 
  	if (!PyArg_ParseTuple(args, "Oz:QueryValue", &obKey, &subKey))
  		return NULL;
***************
*** 1220,1229 ****
  		return PyErr_SetFromWindowsErrWithFunction(rc,
  							   "RegQueryValue");
! 	retBuf = (char *)alloca(bufSize);
  	if ((rc = RegQueryValue(hKey, subKey, retBuf, &bufSize))
! 	    != ERROR_SUCCESS)
  		return PyErr_SetFromWindowsErrWithFunction(rc,
  							   "RegQueryValue");
! 	return Py_BuildValue("s", retBuf);
  }
  
--- 1241,1256 ----
  		return PyErr_SetFromWindowsErrWithFunction(rc,
  							   "RegQueryValue");
! 	retStr = PyString_FromStringAndSize(NULL, bufSize);
! 	if (retStr == NULL)
! 		return NULL;
! 	retBuf = PyString_AS_STRING(retStr);
  	if ((rc = RegQueryValue(hKey, subKey, retBuf, &bufSize))
! 	    != ERROR_SUCCESS) {
! 		Py_DECREF(retStr);
  		return PyErr_SetFromWindowsErrWithFunction(rc,
  							   "RegQueryValue");
! 	}
! 	_PyString_Resize(&retStr, strlen(retBuf));
! 	return retStr;
  }
  
***************
*** 1253,1263 ****
  		return PyErr_SetFromWindowsErrWithFunction(rc,
  							   "RegQueryValueEx");
! 	retBuf = (char *)alloca(bufSize);
  	if ((rc = RegQueryValueEx(hKey, valueName, NULL,
  				  &typ, (BYTE *)retBuf, &bufSize))
! 	    != ERROR_SUCCESS)
  		return PyErr_SetFromWindowsErrWithFunction(rc,
  							   "RegQueryValueEx");
  	obData = Reg2Py(retBuf, bufSize, typ);
  	if (obData == NULL)
  		return NULL;
--- 1280,1295 ----
  		return PyErr_SetFromWindowsErrWithFunction(rc,
  							   "RegQueryValueEx");
! 	retBuf = (char *)PyMem_Malloc(bufSize);
! 	if (retBuf == NULL)
! 		return PyErr_NoMemory();
  	if ((rc = RegQueryValueEx(hKey, valueName, NULL,
  				  &typ, (BYTE *)retBuf, &bufSize))
! 	    != ERROR_SUCCESS) {
! 		PyMem_Free(retBuf);
  		return PyErr_SetFromWindowsErrWithFunction(rc,
  							   "RegQueryValueEx");
+ 	}
  	obData = Reg2Py(retBuf, bufSize, typ);
+ 	PyMem_Free((void *)retBuf);
  	if (obData == NULL)
  		return NULL;