Security patches from Apple: prevent int overflow when allocating memory

This commit is contained in:
Neal Norwitz 2008-07-31 17:17:14 +00:00
parent e70f8e1205
commit e7d8be80ba
13 changed files with 258 additions and 29 deletions

View file

@ -431,6 +431,10 @@ buffer_repeat(PyBufferObject *self, Py_ssize_t count)
count = 0;
if (!get_buf(self, &ptr, &size, ANY_BUFFER))
return NULL;
if (count > PY_SSIZE_T_MAX / size) {
PyErr_SetString(PyExc_MemoryError, "result too large");
return NULL;
}
ob = PyString_FromStringAndSize(NULL, size * count);
if ( ob == NULL )
return NULL;