comparison Modules/arraymodule.c @ 48090:2da42dcbb8ce 2.5

Backport code from r65182: Issue #2620: Overflow checking when allocating or reallocating memory was not always being done properly in some python types and extension modules. PyMem_MALLOC, PyMem_REALLOC, PyMem_NEW and PyMem_RESIZE have all been updated to perform better checks and places in the code that would previously leak memory on the error path when such an allocation failed have been fixed.
author Neal Norwitz <nnorwitz@gmail.com>
date Mon, 28 Jul 2008 05:06:20 +0000
parents 4504dfcc1924
children 787b969d37f0
comparison
equal deleted inserted replaced
48072:b71d76bf4506 48090:2da42dcbb8ce
814 814
815 static int 815 static int
816 array_do_extend(arrayobject *self, PyObject *bb) 816 array_do_extend(arrayobject *self, PyObject *bb)
817 { 817 {
818 Py_ssize_t size; 818 Py_ssize_t size;
819 char *old_item;
819 820
820 if (!array_Check(bb)) 821 if (!array_Check(bb))
821 return array_iter_extend(self, bb); 822 return array_iter_extend(self, bb);
822 #define b ((arrayobject *)bb) 823 #define b ((arrayobject *)bb)
823 if (self->ob_descr != b->ob_descr) { 824 if (self->ob_descr != b->ob_descr) {
829 ((self->ob_size + b->ob_size) > PY_SSIZE_T_MAX / self->ob_descr->itemsize)) { 830 ((self->ob_size + b->ob_size) > PY_SSIZE_T_MAX / self->ob_descr->itemsize)) {
830 PyErr_NoMemory(); 831 PyErr_NoMemory();
831 return -1; 832 return -1;
832 } 833 }
833 size = self->ob_size + b->ob_size; 834 size = self->ob_size + b->ob_size;
835 old_item = self->ob_item;
834 PyMem_RESIZE(self->ob_item, char, size*self->ob_descr->itemsize); 836 PyMem_RESIZE(self->ob_item, char, size*self->ob_descr->itemsize);
835 if (self->ob_item == NULL) { 837 if (self->ob_item == NULL) {
836 PyObject_Del(self); 838 self->ob_item = old_item;
837 PyErr_NoMemory(); 839 PyErr_NoMemory();
838 return -1; 840 return -1;
839 } 841 }
840 memcpy(self->ob_item + self->ob_size*self->ob_descr->itemsize, 842 memcpy(self->ob_item + self->ob_size*self->ob_descr->itemsize,
841 b->ob_item, b->ob_size*b->ob_descr->itemsize); 843 b->ob_item, b->ob_size*b->ob_descr->itemsize);
842 self->ob_size = size; 844 self->ob_size = size;
884 } 886 }
885 else { 887 else {
886 if (size > PY_SSIZE_T_MAX / n) { 888 if (size > PY_SSIZE_T_MAX / n) {
887 return PyErr_NoMemory(); 889 return PyErr_NoMemory();
888 } 890 }
889 PyMem_Resize(items, char, n * size); 891 PyMem_RESIZE(items, char, n * size);
890 if (items == NULL) 892 if (items == NULL)
891 return PyErr_NoMemory(); 893 return PyErr_NoMemory();
892 p = items; 894 p = items;
893 for (i = 1; i < n; i++) { 895 for (i = 1; i < n; i++) {
894 p += size; 896 p += size;