Mercurial > cpython-lru_cache-weakref
diff Objects/stringobject.c @ 49716:200c8aab1917 2.4
- Issue #2587: In the C API, PyString_FromStringAndSize() takes a signed size
parameter but was not verifying that it was greater than zero. Values
less than zero will now raise a SystemError and return NULL to indicate a
bug in the calling C code. CVE-2008-1887.
backport r62261, r62271
| author | Matthias Klose <doko@ubuntu.com> |
|---|---|
| date | Wed, 12 Nov 2008 07:21:52 +0000 |
| parents | 187388c11505 |
| children | 61d06409a660 |
line wrap: on
line diff
--- a/Objects/stringobject.c Wed Nov 12 07:08:51 2008 +0000 +++ b/Objects/stringobject.c Wed Nov 12 07:21:52 2008 +0000 @@ -52,6 +52,13 @@ PyString_FromStringAndSize(const char *str, int size) { register PyStringObject *op; + + if (size < 0) { + PyErr_SetString(PyExc_SystemError, + "Negative size passed to PyString_FromStringAndSize"); + return NULL; + } + if (size == 0 && (op = nullstring) != NULL) { #ifdef COUNT_ALLOCS null_strings++;