mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-03 16:39:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Fix issue2589: there was a potential integer overflow leading to

Browse source 
memory corruption on esoteric platforms and incorrect behavior on
normal platforms.
This commit is contained in:
Gregory P. Smith 2008-05-26 21:16:34 +00:00
parent 06abba3558
commit 23921f00e8
1 changed files with 15 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

19
Python/mysnprintf.c
View file

@ -54,18 +54,28 @@ int
PyOS_vsnprintf(char *str, size_t size, const char *format, va_list va)
{
int len; /* # bytes written, excluding \0 */
#ifndef HAVE_SNPRINTF
#ifdef HAVE_SNPRINTF
#define _PyOS_vsnprintf_EXTRA_SPACE 1
#else
#define _PyOS_vsnprintf_EXTRA_SPACE 512
char *buffer;
#endif
assert(str != NULL);
assert(size > 0);
assert(format != NULL);
/* We take a size_t as input but return an int. Sanity check
* our input so that it won't cause an overflow in the
* vsnprintf return value or the buffer malloc size. */
if (size > INT_MAX - _PyOS_vsnprintf_EXTRA_SPACE) {
len = -666;
goto Done;
}
#ifdef HAVE_SNPRINTF
len = vsnprintf(str, size, format, va);
#else
/* Emulate it. */
buffer = PyMem_MALLOC(size + 512);
buffer = PyMem_MALLOC(size + _PyOS_vsnprintf_EXTRA_SPACE);
if (buffer == NULL) {
len = -666;
goto Done;
@ -75,7 +85,7 @@ PyOS_vsnprintf(char *str, size_t size, const char *format, va_list va)
if (len < 0)
/* ignore the error */;
else if ((size_t)len >= size + 512)
else if ((size_t)len >= size + _PyOS_vsnprintf_EXTRA_SPACE)
Py_FatalError("Buffer overflow in PyOS_snprintf/PyOS_vsnprintf");
else {
@ -86,8 +96,9 @@ PyOS_vsnprintf(char *str, size_t size, const char *format, va_list va)
str[to_copy] = '\0';
}
PyMem_FREE(buffer);
Done:
#endif
Done:
str[size-1] = '\0';
return len;
#undef _PyOS_vsnprintf_EXTRA_SPACE
}