[Python-checkins] cpython (3.2): Issue #15736: Fix overflow in _PySequence_BytesToCharpArray().
stefan.krah
python-checkins at python.org
Tue Aug 21 08:31:43 CEST 2012
http://hg.python.org/cpython/rev/dbbf3ccf72e8
changeset: 78692:dbbf3ccf72e8
branch: 3.2
parent: 78690:9c22222af1f9
user: Stefan Krah <skrah at bytereef.org>
date: Tue Aug 21 08:16:09 2012 +0200
summary:
Issue #15736: Fix overflow in _PySequence_BytesToCharpArray().
files:
Lib/test/test_capi.py | 8 ++++++++
Objects/abstract.c | 7 +++++++
2 files changed, 15 insertions(+), 0 deletions(-)
diff --git a/Lib/test/test_capi.py b/Lib/test/test_capi.py
--- a/Lib/test/test_capi.py
+++ b/Lib/test/test_capi.py
@@ -67,6 +67,14 @@
return 1
self.assertRaises(TypeError, _posixsubprocess.fork_exec,
1,Z(),3,[1, 2],5,6,7,8,9,10,11,12,13,14,15,16,17)
+ # Issue #15736: overflow in _PySequence_BytesToCharpArray()
+ class Z(object):
+ def __len__(self):
+ return sys.maxsize
+ def __getitem__(self, i):
+ return b'x'
+ self.assertRaises(MemoryError, _posixsubprocess.fork_exec,
+ 1,Z(),3,[1, 2],5,6,7,8,9,10,11,12,13,14,15,16,17)
@unittest.skipUnless(_posixsubprocess, '_posixsubprocess required for this test.')
def test_subprocess_fork_exec(self):
diff --git a/Objects/abstract.c b/Objects/abstract.c
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -2728,6 +2728,13 @@
if (argc == -1)
return NULL;
+ assert(argc >= 0);
+
+ if ((size_t)argc > (PY_SSIZE_T_MAX-sizeof(char *)) / sizeof(char *)) {
+ PyErr_NoMemory();
+ return NULL;
+ }
+
array = malloc((argc + 1) * sizeof(char *));
if (array == NULL) {
PyErr_NoMemory();
--
Repository URL: http://hg.python.org/cpython
More information about the Python-checkins
mailing list