From bd47384e07bde38a8f18b90b4cea02a505d95c75 Mon Sep 17 00:00:00 2001 From: Serhiy Storchaka Date: Mon, 16 Jul 2018 09:10:19 +0300 Subject: [PATCH] bpo-24618: Add a check in the code constructor. (GH-8283) Check that the size of the varnames tuple is enough at least for all arguments. --- .../2018-07-14-14-01-37.bpo-24618.iTKjD_.rst | 2 ++ Objects/codeobject.c | 18 +++++++++++++++--- 2 files changed, 17 insertions(+), 3 deletions(-) create mode 100644 Misc/NEWS.d/next/Core and Builtins/2018-07-14-14-01-37.bpo-24618.iTKjD_.rst diff --git a/Misc/NEWS.d/next/Core and Builtins/2018-07-14-14-01-37.bpo-24618.iTKjD_.rst b/Misc/NEWS.d/next/Core and Builtins/2018-07-14-14-01-37.bpo-24618.iTKjD_.rst new file mode 100644 index 00000000000..180b5650121 --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2018-07-14-14-01-37.bpo-24618.iTKjD_.rst @@ -0,0 +1,2 @@ +Fixed reading invalid memory when create the code object with too small +varnames tuple or too large argument counts. diff --git a/Objects/codeobject.c b/Objects/codeobject.c index aa373a075d7..b07667c28df 100644 --- a/Objects/codeobject.c +++ b/Objects/codeobject.c @@ -103,7 +103,7 @@ PyCode_New(int argcount, int kwonlyargcount, { PyCodeObject *co; Py_ssize_t *cell2arg = NULL; - Py_ssize_t i, n_cellvars; + Py_ssize_t i, n_cellvars, n_varnames, total_args; /* Check argument types */ if (argcount < 0 || kwonlyargcount < 0 || nlocals < 0 || @@ -138,10 +138,22 @@ PyCode_New(int argcount, int kwonlyargcount, flags &= ~CO_NOFREE; } + n_varnames = PyTuple_GET_SIZE(varnames); + if (argcount <= n_varnames && kwonlyargcount <= n_varnames) { + /* Never overflows. */ + total_args = (Py_ssize_t)argcount + (Py_ssize_t)kwonlyargcount + + ((flags & CO_VARARGS) != 0) + ((flags & CO_VARKEYWORDS) != 0); + } + else { + total_args = n_varnames + 1; + } + if (total_args > n_varnames) { + PyErr_SetString(PyExc_ValueError, "code: varnames is too small"); + return NULL; + } + /* Create mapping between cells and arguments if needed. */ if (n_cellvars) { - Py_ssize_t total_args = argcount + kwonlyargcount + - ((flags & CO_VARARGS) != 0) + ((flags & CO_VARKEYWORDS) != 0); bool used_cell2arg = false; cell2arg = PyMem_NEW(Py_ssize_t, n_cellvars); if (cell2arg == NULL) {