Mercurial > cpython-lru_cache-weakref
diff Objects/stringobject.c @ 48112:187388c11505 2.4
Security patches from Apple: prevent int overflow when allocating memory
| author | Neal Norwitz <nnorwitz@gmail.com> |
|---|---|
| date | Thu, 31 Jul 2008 17:04:32 +0000 |
| parents | 2a05ee4a23e0 |
| children | 200c8aab1917 |
line wrap: on
line diff
--- a/Objects/stringobject.c Mon Jul 28 05:22:45 2008 +0000 +++ b/Objects/stringobject.c Thu Jul 31 17:04:32 2008 +0000 @@ -69,6 +69,11 @@ return (PyObject *)op; } + if (size > INT_MAX - sizeof(PyStringObject)) { + PyErr_SetString(PyExc_OverflowError, "string is too large"); + return NULL; + } + /* Inline PyObject_NewVar */ op = (PyStringObject *)PyObject_MALLOC(sizeof(PyStringObject) + size); if (op == NULL) @@ -104,7 +109,7 @@ assert(str != NULL); size = strlen(str); - if (size > INT_MAX) { + if (size > INT_MAX - sizeof(PyStringObject)) { PyErr_SetString(PyExc_OverflowError, "string is too long for a Python string"); return NULL; @@ -907,7 +912,18 @@ Py_INCREF(a); return (PyObject *)a; } + /* Check that string sizes are not negative, to prevent an + overflow in cases where we are passed incorrectly-created + strings with negative lengths (due to a bug in other code). + */ size = a->ob_size + b->ob_size; + if (a->ob_size < 0 || b->ob_size < 0 || + a->ob_size > INT_MAX - b->ob_size) { + PyErr_SetString(PyExc_OverflowError, + "strings are too large to concat"); + return NULL; + } + /* Inline PyObject_NewVar */ op = (PyStringObject *)PyObject_MALLOC(sizeof(PyStringObject) + size); if (op == NULL)