Issue #24467: Fixed possible buffer over-read in bytearray. The bytearray

object now always allocates place for trailing null byte and it's buffer now
is always null-terminated.
This commit is contained in:
Serhiy Storchaka 2015-06-29 21:18:01 +03:00
commit bc9e75ed02
3 changed files with 25 additions and 2 deletions

View file

@ -891,8 +891,10 @@ bytearray_init(PyByteArrayObject *self, PyObject *args, PyObject *kwds)
goto error;
/* Append the byte */
if (Py_SIZE(self) < self->ob_alloc)
if (Py_SIZE(self) + 1 < self->ob_alloc) {
Py_SIZE(self)++;
PyByteArray_AS_STRING(self)[Py_SIZE(self)] = '\0';
}
else if (PyByteArray_Resize((PyObject *)self, Py_SIZE(self)+1) < 0)
goto error;
PyByteArray_AS_STRING(self)[Py_SIZE(self)-1] = value;