mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-03 08:34:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

bpo-36946: Fix possible signed integer overflow when handling slices. (GH-13375)

Browse source 
The final addition (cur += step) may overflow, so use size_t for "cur".
"cur" is always positive (even for negative steps), so it is safe to use
size_t here.

Co-Authored-By: Martin Panter <vadmium+py@gmail.com>
This commit is contained in:
Zackery Spytz 2019-05-17 01:13:03 -06:00 • committed by Serhiy Storchaka
parent 870b035bc6
commit 14514d9084
15 changed files with 45 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Objects/bytearrayobject.c
View file

@ -410,7 +410,8 @@ bytearray_subscript(PyByteArrayObject *self, PyObject *index)
return PyLong_FromLong((unsigned char)(PyByteArray_AS_STRING(self)[i]));
}
else if (PySlice_Check(index)) {
Py_ssize_t start, stop, step, slicelength, cur, i;
Py_ssize_t start, stop, step, slicelength, i;
size_t cur;
if (PySlice_Unpack(index, &start, &stop, &step) < 0) {
return NULL;
}

3
Objects/bytesobject.c
View file

@ -1677,7 +1677,8 @@ bytes_subscript(PyBytesObject* self, PyObject* item)
return PyLong_FromLong((unsigned char)self->ob_sval[i]);
}
else if (PySlice_Check(item)) {
Py_ssize_t start, stop, step, slicelength, cur, i;
Py_ssize_t start, stop, step, slicelength, i;
size_t cur;
char* source_buf;
char* result_buf;
PyObject* result;

3
Objects/tupleobject.c
View file

@ -753,7 +753,8 @@ tuplesubscript(PyTupleObject* self, PyObject* item)
return tupleitem(self, i);
}
else if (PySlice_Check(item)) {
Py_ssize_t start, stop, step, slicelength, cur, i;
Py_ssize_t start, stop, step, slicelength, i;
size_t cur;
PyObject* result;
PyObject* it;
PyObject **src, **dest;

3
Objects/unicodeobject.c
View file

@ -13991,7 +13991,8 @@ unicode_subscript(PyObject* self, PyObject* item)
i += PyUnicode_GET_LENGTH(self);
return unicode_getitem(self, i);
} else if (PySlice_Check(item)) {
Py_ssize_t start, stop, step, slicelength, cur, i;
Py_ssize_t start, stop, step, slicelength, i;
size_t cur;
PyObject *result;
void *src_data, *dest_data;
int src_kind, dest_kind;