mirror of
https://github.com/python/cpython.git
synced 2025-11-01 18:51:43 +00:00
SF patch 514641 (Naofumi Honda) - Negative ob_size of LongObjects
Due to the bizarre definition of _PyLong_Copy(), creating an instance of a subclass of long with a negative value could cause core dumps later on. Unfortunately it looks like the behavior of _PyLong_Copy() is quite intentional, so the fix is more work than feels comfortable. This fix is almost, but not quite, the code that Naofumi Honda added; in addition, I added a test case.
This commit is contained in:
parent
6f33250ef9
commit
2eb0b87d14
4 changed files with 23 additions and 4 deletions
|
|
@ -933,8 +933,16 @@ PyNumber_Long(PyObject *o)
|
|||
Py_INCREF(o);
|
||||
return o;
|
||||
}
|
||||
if (PyLong_Check(o))
|
||||
return _PyLong_Copy((PyLongObject *)o);
|
||||
if (PyLong_Check(o)) {
|
||||
PyObject *res;
|
||||
|
||||
res = _PyLong_Copy((PyLongObject *)o);
|
||||
if (res != NULL)
|
||||
((PyLongObject *)res)->ob_size =
|
||||
((PyLongObject *)o)->ob_size;
|
||||
|
||||
return res;
|
||||
}
|
||||
if (PyString_Check(o))
|
||||
/* need to do extra error checking that PyLong_FromString()
|
||||
* doesn't do. In particular long('9.5') must raise an
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue