mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-09-18 22:50:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

SF bug #494738: binascii_b2a_base64 overwrites memory.

Browse source 
binascii_b2a_base64():  We didn't allocate enough buffer space for very
short inputs (e.g., a 1-byte input can produce a 5-byte output, but we
only allocated 2 bytes).  I expect that malloc overheads absorbed the
overrun in practice, but computing a correct upper bound is a very simple
change.
This commit is contained in:
Tim Peters 2001-12-19 04:41:35 +00:00
parent b6d14daa1c
commit 1fbb577ee2
2 changed files with 6 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
Misc/ACKS
View file

@ -92,6 +92,7 @@ Benjamin Collar
Jeffery Collins Jeffery Collins
Matt Conway Matt Conway
David M. Cooke David M. Cooke
David Costanzo
Scott Cotton Scott Cotton
Greg Couch Greg Couch
Steve Cousins Steve Cousins

8
Modules/binascii.c
View file

@ -137,7 +137,7 @@ static char table_a2b_base64[] = {
#define BASE64_PAD '=' #define BASE64_PAD '='
/* Max binary chunk size; limited only by available memory */ /* Max binary chunk size; limited only by available memory */
#define BASE64_MAXBIN (INT_MAX/2 - sizeof(PyStringObject)) #define BASE64_MAXBIN (INT_MAX/2 - sizeof(PyStringObject) - 3)
static unsigned char table_b2a_base64[] = static unsigned char table_b2a_base64[] =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
@ -436,8 +436,10 @@ binascii_b2a_base64(PyObject *self, PyObject *args)
return NULL; return NULL;
} }
/* We're lazy and allocate to much (fixed up later) */ /* We're lazy and allocate too much (fixed up later).
if ( (rv=PyString_FromStringAndSize(NULL, bin_len*2)) == NULL ) "+3" leaves room for up to two pad characters and a trailing
newline. Note that 'b' gets encoded as 'Yg==\n' (1 in, 5 out). */
if ( (rv=PyString_FromStringAndSize(NULL, bin_len*2 + 3)) == NULL )
return NULL; return NULL;
ascii_data = (unsigned char *)PyString_AsString(rv); ascii_data = (unsigned char *)PyString_AsString(rv);