mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-03 16:39:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Issue #1621: Avoid signed overflow in list and tuple operations

Browse source 
Patch by Xiang Zhang.
This commit is contained in:
Martin Panter 2016-07-25 02:39:20 +00:00
parent 32d2ce3561
commit b93d8637a6
4 changed files with 28 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

18
Objects/listobject.c
View file

@ -488,9 +488,9 @@ list_concat(PyListObject *a, PyObject *bb)
return NULL;
}
#define b ((PyListObject *)bb)
size = Py_SIZE(a) + Py_SIZE(b);
if (size < 0)
if (Py_SIZE(a) > PY_SSIZE_T_MAX - Py_SIZE(b))
return PyErr_NoMemory();
size = Py_SIZE(a) + Py_SIZE(b);
np = (PyListObject *) PyList_New(size);
if (np == NULL) {
return NULL;
@ -841,18 +841,20 @@ listextend(PyListObject *self, PyObject *b)
return NULL;
}
m = Py_SIZE(self);
mn = m + n;
if (mn >= m) {
if (m > PY_SSIZE_T_MAX - n) {
/* m + n overflowed; on the chance that n lied, and there really
* is enough room, ignore it. If n was telling the truth, we'll
* eventually run out of memory during the loop.
*/
}
else {
mn = m + n;
/* Make room. */
if (list_resize(self, mn) < 0)
goto error;
/* Make the list sane again. */
Py_SIZE(self) = m;
}
/* Else m + n overflowed; on the chance that n lied, and there really
* is enough room, ignore it. If n was telling the truth, we'll
* eventually run out of memory during the loop.
*/
/* Run iterator to exhaustion. */
for (;;) {

4
Objects/tupleobject.c
View file

@ -453,9 +453,9 @@ tupleconcat(PyTupleObject *a, PyObject *bb)
return NULL;
}
#define b ((PyTupleObject *)bb)
size = Py_SIZE(a) + Py_SIZE(b);
if (size < 0)
if (Py_SIZE(a) > PY_SSIZE_T_MAX - Py_SIZE(b))
return PyErr_NoMemory();
size = Py_SIZE(a) + Py_SIZE(b);
np = (PyTupleObject *) PyTuple_New(size);
if (np == NULL) {
return NULL;