Mercurial > cpython-lru_cache-weakref

diff Objects/stringobject.c @ 42004:e62b606eff0b legacy-trunk

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Prevent expandtabs() on string and unicode objects from causing a segfault when a large width is passed on 32-bit platforms. Found by Google. It would be good for people to review this especially carefully and verify I don't have an off by one error and there is no other way to cause overflow.
author Neal Norwitz <nnorwitz@gmail.com>
date Sat, 09 Jun 2007 03:36:34 +0000
parents cedc8d7d1c7f
children b94f284805be
line wrap: on
line diff
--- a/Objects/stringobject.c	Fri Jun 08 19:14:23 2007 +0000
+++ b/Objects/stringobject.c	Sat Jun 09 03:36:34 2007 +0000
@@ -3307,7 +3307,7 @@
 {
     const char *e, *p;
     char *q;
-    Py_ssize_t i, j;
+    Py_ssize_t i, j, old_j;
     PyObject *u;
     int tabsize = 8;
 
@@ -3315,12 +3315,18 @@
 	return NULL;
 
     /* First pass: determine size of output string */
-    i = j = 0;
+    i = j = old_j = 0;
     e = PyString_AS_STRING(self) + PyString_GET_SIZE(self);
     for (p = PyString_AS_STRING(self); p < e; p++)
         if (*p == '\t') {
-	    if (tabsize > 0)
+	    if (tabsize > 0) {
 		j += tabsize - (j % tabsize);
+		if (old_j > j) {
+		    PyErr_SetString(PyExc_OverflowError, "new string is too long");
+		    return NULL;
+		}
+		old_j = j;
+            }
 	}
         else {
             j++;
@@ -3330,6 +3336,11 @@
             }
         }
 
+    if ((i + j) < 0) {
+        PyErr_SetString(PyExc_OverflowError, "new string is too long");
+        return NULL;
+    }
+
     /* Second pass: create output string and fill it */
     u = PyString_FromStringAndSize(NULL, i + j);
     if (!u)