Mercurial > cpython-lru_cache-weakref
diff Objects/stringobject.c @ 14492:7728b0ea9344 legacy-trunk
Fix for bug 113934. string*n and unicode*n did no overflow checking at
all, either to see whether the # of chars fit in an int, or that the
amount of memory needed fit in a size_t. Checking these is expensive, but
the alternative is silently wrong answers (as in the bug report) or
core dumps (which were easy to provoke using Unicode strings).
| author | Tim Peters <tim.peters@gmail.com> |
|---|---|
| date | Sat, 09 Sep 2000 06:13:41 +0000 |
| parents | 6f6f965c5e2d |
| children | 85038a024b19 |
line wrap: on
line diff
--- a/Objects/stringobject.c Sat Sep 09 06:07:37 2000 +0000 +++ b/Objects/stringobject.c Sat Sep 09 06:13:41 2000 +0000 @@ -393,16 +393,31 @@ register int i; register int size; register PyStringObject *op; + size_t nbytes; if (n < 0) n = 0; + /* watch out for overflows: the size can overflow int, + * and the # of bytes needed can overflow size_t + */ size = a->ob_size * n; + if (n && size / n != a->ob_size) { + PyErr_SetString(PyExc_OverflowError, + "repeated string is too long"); + return NULL; + } if (size == a->ob_size) { Py_INCREF(a); return (PyObject *)a; } - /* PyObject_NewVar is inlined */ + nbytes = size * sizeof(char); + if (nbytes / sizeof(char) != (size_t)size || + nbytes + sizeof(PyStringObject) <= nbytes) { + PyErr_SetString(PyExc_OverflowError, + "repeated string is too long"); + return NULL; + } op = (PyStringObject *) - PyObject_MALLOC(sizeof(PyStringObject) + size * sizeof(char)); + PyObject_MALLOC(sizeof(PyStringObject) + nbytes); if (op == NULL) return PyErr_NoMemory(); PyObject_INIT_VAR(op, &PyString_Type, size);