mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-10-10 00:43:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 18

Issue #22518: Fixed integer overflow issues in "backslashreplace",

Browse source 
"xmlcharrefreplace", and "surrogatepass" error handlers.
This commit is contained in:
Serhiy Storchaka 2014-10-04 14:15:49 +03:00
parent 518e71b18a
commit 2e374098ff
2 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Misc/NEWS
View file

@ -9,6 +9,9 @@ What's New in Python 3.4.3?
Core and Builtins Core and Builtins
----------------- -----------------
- Issue #22518: Fixed integer overflow issues in "backslashreplace",
"xmlcharrefreplace", and "surrogatepass" error handlers.
- Issue #22520: Fix overflow checking when generating the repr of a unicode - Issue #22520: Fix overflow checking when generating the repr of a unicode
object. object.

10
Python/codecs.c
View file

@ -773,7 +773,7 @@ PyObject *PyCodec_XMLCharRefReplaceErrors(PyObject *exc)
Py_ssize_t end; Py_ssize_t end;
PyObject *res; PyObject *res;
unsigned char *outp; unsigned char *outp;
int ressize; Py_ssize_t ressize;
Py_UCS4 ch; Py_UCS4 ch;
if (PyUnicodeEncodeError_GetStart(exc, &start)) if (PyUnicodeEncodeError_GetStart(exc, &start))
return NULL; return NULL;
@ -781,6 +781,8 @@ PyObject *PyCodec_XMLCharRefReplaceErrors(PyObject *exc)
return NULL; return NULL;
if (!(object = PyUnicodeEncodeError_GetObject(exc))) if (!(object = PyUnicodeEncodeError_GetObject(exc)))
return NULL; return NULL;
if (end - start > PY_SSIZE_T_MAX / (2+7+1))
end = start + PY_SSIZE_T_MAX / (2+7+1);
for (i = start, ressize = 0; i < end; ++i) { for (i = start, ressize = 0; i < end; ++i) {
/* object is guaranteed to be "ready" */ /* object is guaranteed to be "ready" */
ch = PyUnicode_READ_CHAR(object, i); ch = PyUnicode_READ_CHAR(object, i);
@ -869,7 +871,7 @@ PyObject *PyCodec_BackslashReplaceErrors(PyObject *exc)
Py_ssize_t end; Py_ssize_t end;
PyObject *res; PyObject *res;
unsigned char *outp; unsigned char *outp;
int ressize; Py_ssize_t ressize;
Py_UCS4 c; Py_UCS4 c;
if (PyUnicodeEncodeError_GetStart(exc, &start)) if (PyUnicodeEncodeError_GetStart(exc, &start))
return NULL; return NULL;
@ -877,6 +879,8 @@ PyObject *PyCodec_BackslashReplaceErrors(PyObject *exc)
return NULL; return NULL;
if (!(object = PyUnicodeEncodeError_GetObject(exc))) if (!(object = PyUnicodeEncodeError_GetObject(exc)))
return NULL; return NULL;
if (end - start > PY_SSIZE_T_MAX / (1+1+8))
end = start + PY_SSIZE_T_MAX / (1+1+8);
for (i = start, ressize = 0; i < end; ++i) { for (i = start, ressize = 0; i < end; ++i) {
/* object is guaranteed to be "ready" */ /* object is guaranteed to be "ready" */
c = PyUnicode_READ_CHAR(object, i); c = PyUnicode_READ_CHAR(object, i);
@ -1023,6 +1027,8 @@ PyCodec_SurrogatePassErrors(PyObject *exc)
code = get_standard_encoding(encoding, &bytelength); code = get_standard_encoding(encoding, &bytelength);
Py_DECREF(encode); Py_DECREF(encode);
if (end - start > PY_SSIZE_T_MAX / bytelength)
end = start + PY_SSIZE_T_MAX / bytelength;
res = PyBytes_FromStringAndSize(NULL, bytelength*(end-start)); res = PyBytes_FromStringAndSize(NULL, bytelength*(end-start));
if (!res) { if (!res) {
Py_DECREF(object); Py_DECREF(object);