mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 00:48:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Issue #16096: Fix several occurrences of potential signed integer overflow. Thanks Serhiy Storchaka.

Browse source
This commit is contained in:
Mark Dickinson 2012-10-06 18:04:49 +01:00
parent a2028733ef
commit c04ddff290
7 changed files with 30 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Objects/tupleobject.c
View file

@ -96,15 +96,11 @@ PyTuple_New(register Py_ssize_t size)
else
#endif
{
Py_ssize_t nbytes = size * sizeof(PyObject *);
/* Check for overflow */
if (nbytes / sizeof(PyObject *) != (size_t)size ||
(nbytes > PY_SSIZE_T_MAX - sizeof(PyTupleObject) - sizeof(PyObject *)))
{
if (size > (PY_SSIZE_T_MAX - sizeof(PyTupleObject) -
sizeof(PyObject *)) / sizeof(PyObject *)) {
return PyErr_NoMemory();
}
/* nbytes += sizeof(PyTupleObject) - sizeof(PyObject *); */
op = PyObject_GC_NewVar(PyTupleObject, &PyTuple_Type, size);
if (op == NULL)
return NULL;
@ -481,9 +477,9 @@ tuplerepeat(PyTupleObject *a, Py_ssize_t n)
if (Py_SIZE(a) == 0)
return PyTuple_New(0);
}
size = Py_SIZE(a) * n;
if (size/Py_SIZE(a) != n)
if (n > PY_SSIZE_T_MAX / Py_SIZE(a))
return PyErr_NoMemory();
size = Py_SIZE(a) * n;
np = (PyTupleObject *) PyTuple_New(size);
if (np == NULL)
return NULL;