diff Modules/selectmodule.c @ 81587:974ace29ee2d 3.2

Issue #15989: Fix several occurrences of integer overflow when result of PyLong_AsLong() narrowed to int without checks. This is a backport of changesets 13e2e44db99d and 525407d89277.
author Serhiy Storchaka <storchaka@gmail.com>
date Sat, 19 Jan 2013 12:26:26 +0200
parents 87ccf2635ad7
children 101e821e5e70 8f10c9eae183
line wrap: on
line diff
--- a/Modules/selectmodule.c	Fri Jan 18 19:55:46 2013 +0200
+++ b/Modules/selectmodule.c	Sat Jan 19 12:26:26 2013 +0200
@@ -340,10 +340,13 @@
 
     i = pos = 0;
     while (PyDict_Next(self->dict, &pos, &key, &value)) {
-        self->ufds[i].fd = PyLong_AsLong(key);
+        assert(i < self->ufd_len);
+        /* Never overflow */
+        self->ufds[i].fd = (int)PyLong_AsLong(key);
         self->ufds[i].events = (short)PyLong_AsLong(value);
         i++;
     }
+    assert(i == self->ufd_len);
     self->ufd_uptodate = 1;
     return 1;
 }
@@ -359,10 +362,11 @@
 poll_register(pollObject *self, PyObject *args)
 {
     PyObject *o, *key, *value;
-    int fd, events = POLLIN | POLLPRI | POLLOUT;
+    int fd;
+    short events = POLLIN | POLLPRI | POLLOUT;
     int err;
 
-    if (!PyArg_ParseTuple(args, "O|i:register", &o, &events)) {
+    if (!PyArg_ParseTuple(args, "O|h:register", &o, &events)) {
         return NULL;
     }
 
@@ -501,7 +505,7 @@
         tout = PyNumber_Long(tout);
         if (!tout)
             return NULL;
-        timeout = PyLong_AsLong(tout);
+        timeout = _PyLong_AsInt(tout);
         Py_DECREF(tout);
         if (timeout == -1 && PyErr_Occurred())
             return NULL;