mirror of
https://github.com/python/cpython.git
synced 2025-08-03 00:23:06 +00:00
Merge in release25-maint r60793:
Added checks for integer overflows, contributed by Google. Some are only available if asserts are left in the code, in cases where they can't be triggered from Python code.
This commit is contained in:
parent
73baefd7fc
commit
9d53457e59
24 changed files with 438 additions and 54 deletions
|
@ -3435,6 +3435,14 @@ load_binstring(Unpicklerobject *self)
|
|||
if (self->read_func(self, &s, 4) < 0) return -1;
|
||||
|
||||
l = calc_binint(s, 4);
|
||||
if (l < 0) {
|
||||
/* Corrupt or hostile pickle -- we never write one like
|
||||
* this.
|
||||
*/
|
||||
PyErr_SetString(UnpicklingError,
|
||||
"BINSTRING pickle has negative byte count");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (self->read_func(self, &s, l) < 0)
|
||||
return -1;
|
||||
|
@ -3502,6 +3510,14 @@ load_binunicode(Unpicklerobject *self)
|
|||
if (self->read_func(self, &s, 4) < 0) return -1;
|
||||
|
||||
l = calc_binint(s, 4);
|
||||
if (l < 0) {
|
||||
/* Corrupt or hostile pickle -- we never write one like
|
||||
* this.
|
||||
*/
|
||||
PyErr_SetString(UnpicklingError,
|
||||
"BINUNICODE pickle has negative byte count");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (self->read_func(self, &s, l) < 0)
|
||||
return -1;
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue