comparison Modules/arraymodule.c @ 79529:152d85b2da3a 3.3

Issue #16096: Fix several occurrences of potential signed integer overflow. Thanks Serhiy Storchaka.
author Mark Dickinson <mdickinson@enthought.com>
date Sat, 06 Oct 2012 18:04:49 +0100
parents 7d82a60850fd
children 757cc49ced54 d2127cdec10e
comparison
equal deleted inserted replaced
79527:5665806908c4 79529:152d85b2da3a
481 if (size < 0) { 481 if (size < 0) {
482 PyErr_BadInternalCall(); 482 PyErr_BadInternalCall();
483 return NULL; 483 return NULL;
484 } 484 }
485 485
486 /* Check for overflow */
487 if (size > PY_SSIZE_T_MAX / descr->itemsize) {
488 return PyErr_NoMemory();
489 }
486 nbytes = size * descr->itemsize; 490 nbytes = size * descr->itemsize;
487 /* Check for overflow */
488 if (nbytes / descr->itemsize != (size_t)size) {
489 return PyErr_NoMemory();
490 }
491 op = (arrayobject *) type->tp_alloc(type, 0); 491 op = (arrayobject *) type->tp_alloc(type, 0);
492 if (op == NULL) { 492 if (op == NULL) {
493 return NULL; 493 return NULL;
494 } 494 }
495 op->ob_descr = descr; 495 op->ob_descr = descr;
1249 int not_enough_bytes; 1249 int not_enough_bytes;
1250 1250
1251 if (!PyArg_ParseTuple(args, "On:fromfile", &f, &n)) 1251 if (!PyArg_ParseTuple(args, "On:fromfile", &f, &n))
1252 return NULL; 1252 return NULL;
1253 1253
1254 if (n < 0) {
1255 PyErr_SetString(PyExc_ValueError, "negative count");
1256 return NULL;
1257 }
1258 if (n > PY_SSIZE_T_MAX / itemsize) {
1259 PyErr_NoMemory();
1260 return NULL;
1261 }
1254 nbytes = n * itemsize; 1262 nbytes = n * itemsize;
1255 if (nbytes < 0 || nbytes/itemsize != n) {
1256 PyErr_NoMemory();
1257 return NULL;
1258 }
1259 1263
1260 b = _PyObject_CallMethodId(f, &PyId_read, "n", nbytes); 1264 b = _PyObject_CallMethodId(f, &PyId_read, "n", nbytes);
1261 if (b == NULL) 1265 if (b == NULL)
1262 return NULL; 1266 return NULL;
1263 1267