mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-12-09 10:37:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

Closes #15910: MD5 and SHA1 crash when "updated" with strings bigger than 2**32 bytes

Browse source
This commit is contained in:
Jesus Cea 2012-09-10 21:39:07 +02:00
parent 03a9d2a20b
commit 3fb774ec5f
4 changed files with 66 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
Modules/md5module.c
View file

@ -51,12 +51,25 @@ static PyObject *
md5_update(md5object *self, PyObject *args)
{
Py_buffer view;
Py_ssize_t n;
unsigned char *buf;
if (!PyArg_ParseTuple(args, "s*:update", &view))
return NULL;
md5_append(&self->md5, (unsigned char*)view.buf,
Py_SAFE_DOWNCAST(view.len, Py_ssize_t, unsigned int));
n = view.len;
buf = (unsigned char *) view.buf;
while (n > 0) {
Py_ssize_t nbytes;
if (n > INT_MAX)
nbytes = INT_MAX;
else
nbytes = n;
md5_append(&self->md5, buf,
Py_SAFE_DOWNCAST(nbytes, Py_ssize_t, unsigned int));
buf += nbytes;
n -= nbytes;
}
PyBuffer_Release(&view);
Py_RETURN_NONE;

17
Modules/shamodule.c
View file

@ -429,12 +429,25 @@ static PyObject *
SHA_update(SHAobject *self, PyObject *args)
{
Py_buffer view;
Py_ssize_t n;
unsigned char *buf;
if (!PyArg_ParseTuple(args, "s*:update", &view))
return NULL;
sha_update(self, (unsigned char*)view.buf,
Py_SAFE_DOWNCAST(view.len, Py_ssize_t, unsigned int));
n = view.len;
buf = (unsigned char *) view.buf;
while (n > 0) {
Py_ssize_t nbytes;
if (n > INT_MAX)
nbytes = INT_MAX;
else
nbytes = n;
sha_update(self, buf,
Py_SAFE_DOWNCAST(nbytes, Py_ssize_t, unsigned int));
buf += nbytes;
n -= nbytes;
}
PyBuffer_Release(&view);
Py_RETURN_NONE;