This commit is contained in:
Benjamin Peterson 2015-02-09 20:58:52 -05:00
commit 22ef9f722e
2 changed files with 13 additions and 2 deletions

View File

@ -13,6 +13,7 @@ Core and Builtins
Library Library
------- -------
- Issue #23361: Fix possible overflow in Windows subprocess creation code.
What's New in Python 3.4.3rc1? What's New in Python 3.4.3rc1?
============================== ==============================

View File

@ -535,13 +535,23 @@ getenvironment(PyObject* environment)
"environment can only contain strings"); "environment can only contain strings");
goto error; goto error;
} }
if (totalsize > PY_SSIZE_T_MAX - PyUnicode_GET_LENGTH(key) - 1) {
PyErr_SetString(PyExc_OverflowError, "environment too long");
goto error;
}
totalsize += PyUnicode_GET_LENGTH(key) + 1; /* +1 for '=' */ totalsize += PyUnicode_GET_LENGTH(key) + 1; /* +1 for '=' */
if (totalsize > PY_SSIZE_T_MAX - PyUnicode_GET_LENGTH(value) - 1) {
PyErr_SetString(PyExc_OverflowError, "environment too long");
goto error;
}
totalsize += PyUnicode_GET_LENGTH(value) + 1; /* +1 for '\0' */ totalsize += PyUnicode_GET_LENGTH(value) + 1; /* +1 for '\0' */
} }
buffer = PyMem_Malloc(totalsize * sizeof(Py_UCS4)); buffer = PyMem_NEW(Py_UCS4, totalsize);
if (! buffer) if (! buffer) {
PyErr_NoMemory();
goto error; goto error;
}
p = buffer; p = buffer;
end = buffer + totalsize; end = buffer + totalsize;