mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-31 14:07:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Issue #23985: Fix a possible buffer overrun when deleting a slice from the front of a bytearray and then appending some other bytes data.

Browse source 
Patch by Martin Panter.
This commit is contained in:
Antoine Pitrou 2015-05-19 20:55:42 +02:00
commit ef64847f71
3 changed files with 21 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Objects/bytearrayobject.c
View file

@ -187,7 +187,7 @@ PyByteArray_Resize(PyObject *self, Py_ssize_t requested_size)
return -1;
}
if (size + logical_offset + 1 < alloc) {
if (size + logical_offset + 1 <= alloc) {
/* Current buffer is large enough to host the requested size,
decide on a strategy. */
if (size < alloc / 2) {
@ -331,11 +331,7 @@ bytearray_iconcat(PyByteArrayObject *self, PyObject *other)
PyBuffer_Release(&vo);
return PyErr_NoMemory();
}
if (size < self->ob_alloc) {
Py_SIZE(self) = size;
PyByteArray_AS_STRING(self)[Py_SIZE(self)] = '\0'; /* Trailing null byte */
}
else if (PyByteArray_Resize((PyObject *)self, size) < 0) {
if (PyByteArray_Resize((PyObject *)self, size) < 0) {
PyBuffer_Release(&vo);
return NULL;
}