Mercurial > cpython-lru_cache-weakref
diff Modules/selectmodule.c @ 81590:d544873d62e9 2.7
Issue #15989: Fix several occurrences of integer overflow
when result of PyInt_AsLong() or PyLong_AsLong() narrowed
to int without checks.
This is a backport of changesets 13e2e44db99d and 525407d89277.
| author | Serhiy Storchaka <storchaka@gmail.com> |
|---|---|
| date | Sat, 19 Jan 2013 12:55:39 +0200 |
| parents | 02a5322b0cee |
| children | 1d33c79d2f6b |
line wrap: on
line diff
--- a/Modules/selectmodule.c Fri Jan 18 23:23:11 2013 -0800 +++ b/Modules/selectmodule.c Sat Jan 19 12:55:39 2013 +0200 @@ -343,10 +343,13 @@ i = pos = 0; while (PyDict_Next(self->dict, &pos, &key, &value)) { - self->ufds[i].fd = PyInt_AsLong(key); + assert(i < self->ufd_len); + /* Never overflow */ + self->ufds[i].fd = (int)PyInt_AsLong(key); self->ufds[i].events = (short)PyInt_AsLong(value); i++; } + assert(i == self->ufd_len); self->ufd_uptodate = 1; return 1; } @@ -362,10 +365,11 @@ poll_register(pollObject *self, PyObject *args) { PyObject *o, *key, *value; - int fd, events = POLLIN | POLLPRI | POLLOUT; + int fd; + short events = POLLIN | POLLPRI | POLLOUT; int err; - if (!PyArg_ParseTuple(args, "O|i:register", &o, &events)) { + if (!PyArg_ParseTuple(args, "O|h:register", &o, &events)) { return NULL; } @@ -503,7 +507,7 @@ tout = PyNumber_Int(tout); if (!tout) return NULL; - timeout = PyInt_AsLong(tout); + timeout = _PyInt_AsInt(tout); Py_DECREF(tout); if (timeout == -1 && PyErr_Occurred()) return NULL;
