mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-12 12:58:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Issue #28275: Fixed possible use adter free in LZMADecompressor.decompress().

Browse source 
Original patch by John Leitch.
This commit is contained in:
Serhiy Storchaka 2016-09-27 20:24:19 +03:00
commit be43f2019f
3 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Lib/test/test_lzma.py
View file

@ -246,6 +246,15 @@ class CompressorDecompressorTestCase(unittest.TestCase):
lzd = LZMADecompressor(lzma.FORMAT_RAW, filters=FILTERS_RAW_1) lzd = LZMADecompressor(lzma.FORMAT_RAW, filters=FILTERS_RAW_1)
self.assertRaises(LZMAError, lzd.decompress, COMPRESSED_XZ) self.assertRaises(LZMAError, lzd.decompress, COMPRESSED_XZ)
def test_decompressor_bug_28275(self):
# Test coverage for Issue 28275
lzd = LZMADecompressor()
for i in range(2):
try:
lzd.decompress(COMPRESSED_RAW_1)
except LZMAError:
pass
# Test that LZMACompressor->LZMADecompressor preserves the input data. # Test that LZMACompressor->LZMADecompressor preserves the input data.
def test_roundtrip_xz(self): def test_roundtrip_xz(self):

3
Misc/NEWS
View file

@ -47,6 +47,9 @@ Core and Builtins
Library Library
------- -------
- Issue #28275: Fixed possible use adter free in LZMADecompressor.decompress().
Original patch by John Leitch.
- Issue #27897: Fixed possible crash in sqlite3.Connection.create_collation() - Issue #27897: Fixed possible crash in sqlite3.Connection.create_collation()
if pass invalid string-like object as a name. Patch by Xiang Zhang. if pass invalid string-like object as a name. Patch by Xiang Zhang.

4
Modules/_lzmamodule.c
View file

@ -995,8 +995,10 @@ decompress(Decompressor *d, uint8_t *data, size_t len, Py_ssize_t max_length)
} }
result = decompress_buf(d, max_length); result = decompress_buf(d, max_length);
if(result == NULL) if (result == NULL) {
lzs->next_in = NULL;
return NULL; return NULL;
}
if (d->eof) { if (d->eof) {
d->needs_input = 0; d->needs_input = 0;