Mercurial > cpython-lru_cache-weakref
diff Python/traceback.c @ 1909:0c232194a64f legacy-trunk
* Python/traceback.c: security fix -- check for buffer oveflow
before concatenating sys.path item and module name
| author | Guido van Rossum <guido@python.org> |
|---|---|
| date | Thu, 29 Sep 1994 09:38:04 +0000 |
| parents | 216b755515e6 |
| children | d7e91437f0a2 |
line wrap: on
line diff
--- a/Python/traceback.c Wed Sep 28 15:51:32 1994 +0000 +++ b/Python/traceback.c Thu Sep 29 09:38:04 1994 +0000 @@ -178,13 +178,18 @@ path = sysget("path"); if (path != NULL && is_listobject(path)) { int npath = getlistsize(path); + int taillen = strlen(tail); char namebuf[MAXPATHLEN+1]; for (i = 0; i < npath; i++) { object *v = getlistitem(path, i); if (is_stringobject(v)) { int len; + len = getstringsize(v); + if (len + 1 + taillen >= MAXPATHLEN) + continue; /* Too long */ strcpy(namebuf, getstringvalue(v)); - len = getstringsize(v); + if (strlen(namebuf) != len) + continue; /* v contains '\0' */ if (len > 0 && namebuf[len-1] != SEP) namebuf[len++] = SEP; strcpy(namebuf+len, tail);