mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-21 01:15:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Added checks for integer overflows, contributed by Google. Some are

Browse source 
only available if asserts are left in the code, in cases where they
can't be triggered from Python code.
This commit is contained in:
Martin v. Löwis 2008-02-14 11:26:18 +00:00
parent abcb59a1d8
commit 73c01d4101
25 changed files with 464 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

36
Python/asdl.c
View file

@ -5,8 +5,22 @@ asdl_seq *
asdl_seq_new(int size, PyArena *arena)
{
asdl_seq *seq = NULL;
size_t n = sizeof(asdl_seq) +
(size ? (sizeof(void *) * (size - 1)) : 0);
size_t n = (size ? (sizeof(void *) * (size - 1)) : 0);
/* check size is sane */
if (size < 0 || size == INT_MIN ||
(size && ((size - 1) > (PY_SIZE_MAX / sizeof(void *))))) {
PyErr_NoMemory();
return NULL;
}
/* check if size can be added safely */
if (n > PY_SIZE_MAX - sizeof(asdl_seq)) {
PyErr_NoMemory();
return NULL;
}
n += sizeof(asdl_seq);
seq = (asdl_seq *)PyArena_Malloc(arena, n);
if (!seq) {
@ -22,8 +36,22 @@ asdl_int_seq *
asdl_int_seq_new(int size, PyArena *arena)
{
asdl_int_seq *seq = NULL;
size_t n = sizeof(asdl_seq) +
(size ? (sizeof(int) * (size - 1)) : 0);
size_t n = (size ? (sizeof(void *) * (size - 1)) : 0);
/* check size is sane */
if (size < 0 || size == INT_MIN ||
(size && ((size - 1) > (PY_SIZE_MAX / sizeof(void *))))) {
PyErr_NoMemory();
return NULL;
}
/* check if size can be added safely */
if (n > PY_SIZE_MAX - sizeof(asdl_seq)) {
PyErr_NoMemory();
return NULL;
}
n += sizeof(asdl_seq);
seq = (asdl_int_seq *)PyArena_Malloc(arena, n);
if (!seq) {

3
Python/ast.c
View file

@ -3130,6 +3130,9 @@ decode_unicode(const char *s, size_t len, int rawmode, const char *encoding)
buf = (char *)s;
u = NULL;
} else {
/* check for integer overflow */
if (len > PY_SIZE_MAX / 4)
return NULL;
/* "\XX" may become "\u005c\uHHLL" (12 bytes) */
u = PyString_FromStringAndSize((char *)NULL, len * 4);
if (u == NULL)

60
Python/bltinmodule.c
View file

@ -2496,11 +2496,43 @@ filterstring(PyObject *func, PyObject *strobj)
PyString_AS_STRING(item)[0];
} else {
/* do we need more space? */
Py_ssize_t need = j + reslen + len-i-1;
Py_ssize_t need = j;
/* calculate space requirements while checking for overflow */
if (need > PY_SSIZE_T_MAX - reslen) {
Py_DECREF(item);
goto Fail_1;
}
need += reslen;
if (need > PY_SSIZE_T_MAX - len) {
Py_DECREF(item);
goto Fail_1;
}
need += len;
if (need <= i) {
Py_DECREF(item);
goto Fail_1;
}
need = need - i - 1;
assert(need >= 0);
assert(outlen >= 0);
if (need > outlen) {
/* overallocate, to avoid reallocations */
if (need<2*outlen)
if (outlen > PY_SSIZE_T_MAX / 2) {
Py_DECREF(item);
return NULL;
}
if (need<2*outlen) {
need = 2*outlen;
}
if (_PyString_Resize(&result, need)) {
Py_DECREF(item);
return NULL;
@ -2592,11 +2624,31 @@ filterunicode(PyObject *func, PyObject *strobj)
else {
/* do we need more space? */
Py_ssize_t need = j + reslen + len - i - 1;
/* check that didnt overflow */
if ((j > PY_SSIZE_T_MAX - reslen) ||
((j + reslen) > PY_SSIZE_T_MAX - len) ||
((j + reslen + len) < i) ||
((j + reslen + len - i) <= 0)) {
Py_DECREF(item);
return NULL;
}
assert(need >= 0);
assert(outlen >= 0);
if (need > outlen) {
/* overallocate,
to avoid reallocations */
if (need < 2 * outlen)
need = 2 * outlen;
if (need < 2 * outlen) {
if (outlen > PY_SSIZE_T_MAX / 2) {
Py_DECREF(item);
return NULL;
} else {
need = 2 * outlen;
}
}
if (PyUnicode_Resize(
&result, need) < 0) {
Py_DECREF(item);

34
Python/compile.c
View file

@ -225,6 +225,10 @@ _Py_Mangle(PyObject *privateobj, PyObject *ident)
return ident; /* Don't mangle if class is just underscores */
}
plen = strlen(p);
assert(1 <= PY_SSIZE_T_MAX - nlen);
assert(1 + nlen <= PY_SSIZE_T_MAX - plen);
ident = PyString_FromStringAndSize(NULL, 1 + nlen + plen);
if (!ident)
return 0;
@ -620,6 +624,8 @@ markblocks(unsigned char *code, int len)
unsigned int *blocks = (unsigned int *)PyMem_Malloc(len*sizeof(int));
int i,j, opcode, blockcnt = 0;
assert(len <= PY_SIZE_MAX / sizeof(int));
if (blocks == NULL) {
PyErr_NoMemory();
return NULL;
@ -1281,6 +1287,12 @@ compiler_next_instr(struct compiler *c, basicblock *b)
size_t oldsize, newsize;
oldsize = b->b_ialloc * sizeof(struct instr);
newsize = oldsize << 1;
if (oldsize > (PY_SIZE_MAX >> 1)) {
PyErr_NoMemory();
return -1;
}
if (newsize == 0) {
PyErr_NoMemory();
return -1;
@ -4091,6 +4103,10 @@ assemble_init(struct assembler *a, int nblocks, int firstlineno)
a->a_lnotab = PyString_FromStringAndSize(NULL, DEFAULT_LNOTAB_SIZE);
if (!a->a_lnotab)
return 0;
if (nblocks > PY_SIZE_MAX / sizeof(basicblock *)) {
PyErr_NoMemory();
return 0;
}
a->a_postorder = (basicblock **)PyObject_Malloc(
sizeof(basicblock *) * nblocks);
if (!a->a_postorder) {
@ -4199,10 +4215,14 @@ assemble_lnotab(struct assembler *a, struct instr *i)
nbytes = a->a_lnotab_off + 2 * ncodes;
len = PyString_GET_SIZE(a->a_lnotab);
if (nbytes >= len) {
if (len * 2 < nbytes)
if ((len <= INT_MAX / 2) && (len * 2 < nbytes))
len = nbytes;
else
else if (len <= INT_MAX / 2)
len *= 2;
else {
PyErr_NoMemory();
return 0;
}
if (_PyString_Resize(&a->a_lnotab, len) < 0)
return 0;
}
@ -4221,10 +4241,14 @@ assemble_lnotab(struct assembler *a, struct instr *i)
nbytes = a->a_lnotab_off + 2 * ncodes;
len = PyString_GET_SIZE(a->a_lnotab);
if (nbytes >= len) {
if (len * 2 < nbytes)
if ((len <= INT_MAX / 2) && len * 2 < nbytes)
len = nbytes;
else
else if (len <= INT_MAX / 2)
len *= 2;
else {
PyErr_NoMemory();
return 0;
}
if (_PyString_Resize(&a->a_lnotab, len) < 0)
return 0;
}
@ -4283,6 +4307,8 @@ assemble_emit(struct assembler *a, struct instr *i)
if (i->i_lineno && !assemble_lnotab(a, i))
return 0;
if (a->a_offset + size >= len) {
if (len > PY_SSIZE_T_MAX / 2)
return 0;
if (_PyString_Resize(&a->a_bytecode, len * 2) < 0)
return 0;
}