mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-30 21:48:47 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

Issue #12847: Fix a crash with negative PUT and LONG_BINPUT arguments in

Browse source 
the C pickle implementation.
This commit is contained in:
Antoine Pitrou 2011-08-30 00:28:40 +02:00
commit a514eb95f3
4 changed files with 31 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
Modules/_pickle.c
View file

@ -4873,8 +4873,12 @@ load_put(UnpicklerObject *self)
return -1;
idx = PyLong_AsSsize_t(key);
Py_DECREF(key);
if (idx == -1 && PyErr_Occurred())
if (idx < 0) {
if (!PyErr_Occurred())
PyErr_SetString(PyExc_ValueError,
"negative PUT argument");
return -1;
}
return _Unpickler_MemoPut(self, idx, value);
}
@ -4913,6 +4917,11 @@ load_long_binput(UnpicklerObject *self)
value = self->stack->data[Py_SIZE(self->stack) - 1];
idx = calc_binsize(s, 4);
if (idx < 0) {
PyErr_SetString(PyExc_ValueError,
"negative LONG_BINPUT argument");
return -1;
}
return _Unpickler_MemoPut(self, idx, value);
}