[3.13] gh-126594: Fix typeobject.c wrap_buffer() cast (GH-126754) (#127004)

gh-126594: Fix typeobject.c wrap_buffer() cast (GH-126754)

Reject flags smaller than INT_MIN.

(cherry picked from commit 84f07c3a4c)

Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
This commit is contained in:
Miss Islington (bot) 2024-11-19 09:38:06 +01:00 committed by GitHub
parent 190d710e68
commit fd276ad328
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 18 additions and 3 deletions

View file

@ -8952,13 +8952,13 @@ wrap_buffer(PyObject *self, PyObject *args, void *wrapped)
if (flags == -1 && PyErr_Occurred()) {
return NULL;
}
if (flags > INT_MAX) {
if (flags > INT_MAX || flags < INT_MIN) {
PyErr_SetString(PyExc_OverflowError,
"buffer flags too large");
"buffer flags out of range");
return NULL;
}
return _PyMemoryView_FromBufferProc(self, Py_SAFE_DOWNCAST(flags, Py_ssize_t, int),
return _PyMemoryView_FromBufferProc(self, (int)flags,
(getbufferproc)wrapped);
}