Mercurial > cpython-lru_cache-weakref
diff Objects/stringobject.c @ 38299:ae6bbf2f2a41 legacy-trunk
needforspeed: check for overflow in replace (from Andrew Dalke)
| author | Fredrik Lundh <fredrik@pythonware.com> |
|---|---|
| date | Thu, 25 May 2006 16:46:54 +0000 |
| parents | 41768de17ead |
| children | 41809406a35e |
line wrap: on
line diff
--- a/Objects/stringobject.c Thu May 25 16:39:27 2006 +0000 +++ b/Objects/stringobject.c Thu May 25 16:46:54 2006 +0000 @@ -2460,6 +2460,7 @@ char *out_s; char *new_s; Py_ssize_t nfound, offset, new_len; + Py_ssize_t product, delta; if (len == 0 || (pat_len == 0 && sub_len == 0) || pat_len > len) goto return_same; @@ -2473,7 +2474,24 @@ if (nfound == 0) goto return_same; - new_len = len + nfound*(sub_len - pat_len); + delta = (sub_len - pat_len); + if (delta == 0) { + new_len = len; + } else { + product = nfound * (sub_len - pat_len); + if ((product / (sub_len - pat_len)) != nfound) { + PyErr_SetString(PyExc_OverflowError, + "replace string is too long"); + return NULL; + } + new_len = len + product; + if (new_len < 0) { + PyErr_SetString(PyExc_OverflowError, + "replace string is too long"); + return NULL; + } + } + if (new_len == 0) { /* Have to allocate something for the caller to free(). */ out_s = (char *)PyMem_MALLOC(1); @@ -2578,7 +2596,8 @@ new_s = mymemreplace(str,len,sub,sub_len,repl,repl_len,count,&out_len); if (new_s == NULL) { - PyErr_NoMemory(); + if (!PyErr_Occurred()) + PyErr_NoMemory(); return NULL; } if (out_len == -1) {