Mercurial > cpython-lru_cache-weakref
diff Python/marshal.c @ 56297:08e59076d86b 3.1
Merged revisions 75145 via svnmerge from
svn+ssh://pythondev@www.python.org/python/branches/py3k
................
r75145 | mark.dickinson | 2009-09-29 20:21:35 +0100 (Tue, 29 Sep 2009) | 10 lines
Merged revisions 75141 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/trunk
........
r75141 | mark.dickinson | 2009-09-29 20:01:06 +0100 (Tue, 29 Sep 2009) | 3 lines
Issue #7019: Unmarshalling of bad long data could produce unnormalized
PyLongs. Raise ValueError instead.
........
................
| author | Mark Dickinson <dickinsm@gmail.com> |
|---|---|
| date | Tue, 29 Sep 2009 19:24:38 +0000 |
| parents | 19e959626109 |
| children | f197407bdba2 0f9e8d3ecac3 |
line wrap: on
line diff
--- a/Python/marshal.c Tue Sep 29 19:02:24 2009 +0000 +++ b/Python/marshal.c Tue Sep 29 19:24:38 2009 +0000 @@ -553,7 +553,7 @@ r_PyLong(RFILE *p) { PyLongObject *ob; - int size, i, j, md; + int size, i, j, md, shorts_in_top_digit; long n; digit d; @@ -566,7 +566,8 @@ return NULL; } - size = 1 + (ABS(n)-1) / PyLong_MARSHAL_RATIO; + size = 1 + (ABS(n) - 1) / PyLong_MARSHAL_RATIO; + shorts_in_top_digit = 1 + (ABS(n) - 1) % PyLong_MARSHAL_RATIO; ob = _PyLong_New(size); if (ob == NULL) return NULL; @@ -583,12 +584,21 @@ ob->ob_digit[i] = d; } d = 0; - for (j=0; j < (ABS(n)-1)%PyLong_MARSHAL_RATIO + 1; j++) { + for (j=0; j < shorts_in_top_digit; j++) { md = r_short(p); if (md < 0 || md > PyLong_MARSHAL_BASE) goto bad_digit; + /* topmost marshal digit should be nonzero */ + if (md == 0 && j == shorts_in_top_digit - 1) { + Py_DECREF(ob); + PyErr_SetString(PyExc_ValueError, + "bad marshal data (unnormalized long data)"); + return NULL; + } d += (digit)md << j*PyLong_MARSHAL_SHIFT; } + /* top digit should be nonzero, else the resulting PyLong won't be + normalized */ ob->ob_digit[size-1] = d; return (PyObject *)ob; bad_digit: