mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-10-09 16:34:44 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 17

bpo-34973: Fix crash in bytes constructor. (GH-9841)

Browse source 
Constructing bytes from mutating list could cause a crash.
This commit is contained in:
Serhiy Storchaka 2018-10-21 15:25:53 +03:00 • committed by GitHub
parent a323cdcb33
commit 914f9a078f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 88 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

104
Objects/bytesobject.c
View file

@ -2639,49 +2639,83 @@ fail:
return NULL;
}
#define _PyBytes_FROM_LIST_BODY(x, GET_ITEM) \
do { \
PyObject *bytes; \
Py_ssize_t i; \
Py_ssize_t value; \
char *str; \
PyObject *item; \
\
bytes = PyBytes_FromStringAndSize(NULL, Py_SIZE(x)); \
if (bytes == NULL) \
return NULL; \
str = ((PyBytesObject *)bytes)->ob_sval; \
\
for (i = 0; i < Py_SIZE(x); i++) { \
item = GET_ITEM((x), i); \
value = PyNumber_AsSsize_t(item, NULL); \
if (value == -1 && PyErr_Occurred()) \
goto error; \
\
if (value < 0 || value >= 256) { \
PyErr_SetString(PyExc_ValueError, \
"bytes must be in range(0, 256)"); \
goto error; \
} \
*str++ = (char) value; \
} \
return bytes; \
\
error: \
Py_DECREF(bytes); \
return NULL; \
} while (0)
static PyObject*
_PyBytes_FromList(PyObject *x)
{
_PyBytes_FROM_LIST_BODY(x, PyList_GET_ITEM);
Py_ssize_t i, size = PyList_GET_SIZE(x);
Py_ssize_t value;
char *str;
PyObject *item;
_PyBytesWriter writer;
_PyBytesWriter_Init(&writer);
str = _PyBytesWriter_Alloc(&writer, size);
if (str == NULL)
return NULL;
writer.overallocate = 1;
size = writer.allocated;
for (i = 0; i < PyList_GET_SIZE(x); i++) {
item = PyList_GET_ITEM(x, i);
Py_INCREF(item);
value = PyNumber_AsSsize_t(item, NULL);
Py_DECREF(item);
if (value == -1 && PyErr_Occurred())
goto error;
if (value < 0 || value >= 256) {
PyErr_SetString(PyExc_ValueError,
"bytes must be in range(0, 256)");
goto error;
}
if (i >= size) {
str = _PyBytesWriter_Resize(&writer, str, size+1);
if (str == NULL)
return NULL;
size = writer.allocated;
}
*str++ = (char) value;
}
return _PyBytesWriter_Finish(&writer, str);
error:
_PyBytesWriter_Dealloc(&writer);
return NULL;
}
static PyObject*
_PyBytes_FromTuple(PyObject *x)
{
_PyBytes_FROM_LIST_BODY(x, PyTuple_GET_ITEM);
PyObject *bytes;
Py_ssize_t i, size = PyTuple_GET_SIZE(x);
Py_ssize_t value;
char *str;
PyObject *item;
bytes = PyBytes_FromStringAndSize(NULL, size);
if (bytes == NULL)
return NULL;
str = ((PyBytesObject *)bytes)->ob_sval;
for (i = 0; i < size; i++) {
item = PyTuple_GET_ITEM(x, i);
value = PyNumber_AsSsize_t(item, NULL);
if (value == -1 && PyErr_Occurred())
goto error;
if (value < 0 || value >= 256) {
PyErr_SetString(PyExc_ValueError,
"bytes must be in range(0, 256)");
goto error;
}
*str++ = (char) value;
}
return bytes;
error:
Py_DECREF(bytes);
return NULL;
}
static PyObject *