Mercurial > cpython-lru_cache-weakref

changeset 79005:2fa7c104f909

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fix out of bounds read in long_new() for empty bytes with an explicit base. int(b'', somebase) calls PyLong_FromString() with char* of length 1 but the function accesses the first argument at offset 1. CID 715359
author Christian Heimes <christian@cheimes.de>
date Wed, 12 Sep 2012 15:32:06 +0200
parents 25e41fdc4e60 (current diff) 3d5db784821f (diff)
children c1b950541e46 8d22d9528164
files Objects/longobject.c
diffstat 1 files changed, 2 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/Objects/longobject.c	Wed Sep 12 00:12:29 2012 -0400
+++ b/Objects/longobject.c	Wed Sep 12 15:32:06 2012 +0200
@@ -4285,8 +4285,8 @@
             string = PyByteArray_AS_STRING(x);
         else
             string = PyBytes_AS_STRING(x);
-        if (strlen(string) != (size_t)size) {
-            /* We only see this if there's a null byte in x,
+        if (strlen(string) != (size_t)size || !size) {
+            /* We only see this if there's a null byte in x or x is empty,
                x is a bytes or buffer, *and* a base is given. */
             PyErr_Format(PyExc_ValueError,
                          "invalid literal for int() with base %d: %R",