Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

Issue #27507: Check for integer overflow in bytearray.extend() 

Patch by Xiang Zhang.
This commit is contained in:
Martin Panter 2016-07-18 07:53:13 +00:00
parent 5852fa3f72
commit 371731ebfd
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Misc/NEWS
View File

@ -22,6 +22,9 @@ Core and Builtins
- Issue #27473: Fixed possible integer overflow in bytes and bytearray
concatenations. Patch by Xiang Zhang.
- Issue #27507: Add integer overflow check in bytearray.extend(). Patch by
Xiang Zhang.
- Issue #27443: __length_hint__() of bytearray iterators no longer return a
negative integer for a resized bytearray.

12
Objects/bytearrayobject.c
View File

@ -2474,7 +2474,17 @@ bytearray_extend(PyByteArrayObject *self, PyObject *iterable_of_ints)
Py_DECREF(item);
if (len >= buf_size) {
buf_size = len + (len >> 1) + 1;
Py_ssize_t addition;
if (len == PY_SSIZE_T_MAX) {
Py_DECREF(it);
Py_DECREF(bytearray_obj);
return PyErr_NoMemory();
}
addition = len >> 1;
if (addition > PY_SSIZE_T_MAX - len - 1)
buf_size = PY_SSIZE_T_MAX;
else
buf_size = len + addition + 1;
if (PyByteArray_Resize((PyObject *)bytearray_obj, buf_size) < 0) {
Py_DECREF(it);
Py_DECREF(bytearray_obj);