mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-11-01 18:51:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 21

Prevent expandtabs() on string and unicode objects from causing a segfault when

Browse source 
a large width is passed on 32-bit platforms.  Found by Google.

It would be good for people to review this especially carefully and verify
I don't have an off by one error and there is no other way to cause overflow.
This commit is contained in:
Neal Norwitz 2007-06-09 03:36:34 +00:00
parent ea7f88e3d9
commit 7dbd2a3720
5 changed files with 49 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

17
Objects/stringobject.c
View file

@ -3307,7 +3307,7 @@ string_expandtabs(PyStringObject *self, PyObject *args)
{
const char *e, *p;
char *q;
Py_ssize_t i, j;
Py_ssize_t i, j, old_j;
PyObject *u;
int tabsize = 8;
@ -3315,12 +3315,18 @@ string_expandtabs(PyStringObject *self, PyObject *args)
return NULL;
/* First pass: determine size of output string */
i = j = 0;
i = j = old_j = 0;
e = PyString_AS_STRING(self) + PyString_GET_SIZE(self);
for (p = PyString_AS_STRING(self); p < e; p++)
if (*p == '\t') {
if (tabsize > 0)
if (tabsize > 0) {
j += tabsize - (j % tabsize);
if (old_j > j) {
PyErr_SetString(PyExc_OverflowError, "new string is too long");
return NULL;
}
old_j = j;
}
}
else {
j++;
@ -3330,6 +3336,11 @@ string_expandtabs(PyStringObject *self, PyObject *args)
}
}
if ((i + j) < 0) {
PyErr_SetString(PyExc_OverflowError, "new string is too long");
return NULL;
}
/* Second pass: create output string and fill it */
u = PyString_FromStringAndSize(NULL, i + j);
if (!u)