mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-27 04:05:34 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

fix integer overflow in unicode case operations (closes #22643)

Browse source
This commit is contained in:
Benjamin Peterson 2014-10-15 11:47:36 -04:00
parent 77a75b3db1
commit e1bd38c03c
3 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
Objects/unicodeobject.c
View file

@ -9484,6 +9484,11 @@ case_operation(PyObject *self,
kind = PyUnicode_KIND(self);
data = PyUnicode_DATA(self);
length = PyUnicode_GET_LENGTH(self);
if (length > PY_SSIZE_T_MAX / 3 ||
length > PY_SIZE_MAX / (3 * sizeof(Py_UCS4))) {
PyErr_SetString(PyExc_OverflowError, "string is too long");
return NULL;
}
tmp = PyMem_MALLOC(sizeof(Py_UCS4) * 3 * length);
if (tmp == NULL)
return PyErr_NoMemory();