Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

Issue #4935: The overflow checking code in the expandtabs() method common 

to str, bytes and bytearray could be optimized away by the compiler, letting
the interpreter segfault instead of raising an error.
This commit is contained in:
Antoine Pitrou 2009-01-13 23:13:52 +00:00
parent 3a5067c208
commit c2f02216b6
2 changed files with 39 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Misc/NEWS
View File

@ -12,6 +12,10 @@ What's New in Python 2.7 alpha 1
Core and Builtins
-----------------
- Issue #4935: The overflow checking code in the expandtabs() method common
to str, bytes and bytearray could be optimized away by the compiler, letting
the interpreter segfault instead of raising an error.
- Issue #3720: Fix a crash when an iterator modifies its class and removes its
__next__ method.

19
Objects/stringlib/transmogrify.h
View File

@ -22,7 +22,7 @@ stringlib_expandtabs(PyObject *self, PyObject *args)
{
const char *e, *p;
char *q;
Py_ssize_t i, j, old_j;
size_t i, j;
PyObject *u;
int tabsize = 8;
@ -30,30 +30,25 @@ stringlib_expandtabs(PyObject *self, PyObject *args)
return NULL;
/* First pass: determine size of output string */
i = j = old_j = 0;
i = j = 0;
e = STRINGLIB_STR(self) + STRINGLIB_LEN(self);
for (p = STRINGLIB_STR(self); p < e; p++)
if (*p == '\t') {
if (tabsize > 0) {
j += tabsize - (j % tabsize);
/* XXX: this depends on a signed integer overflow to < 0 */
/* C compilers, including gcc, do -NOT- guarantee this. */
if (old_j > j) {
if (j > PY_SSIZE_T_MAX) {
PyErr_SetString(PyExc_OverflowError,
"result is too long");
return NULL;
}
old_j = j;
}
}
else {
j++;
if (*p == '\n' || *p == '\r') {
i += j;
old_j = j = 0;
/* XXX: this depends on a signed integer overflow to < 0 */
/* C compilers, including gcc, do -NOT- guarantee this. */
if (i < 0) {
j = 0;
if (i > PY_SSIZE_T_MAX) {
PyErr_SetString(PyExc_OverflowError,
"result is too long");
return NULL;
@ -61,9 +56,7 @@ stringlib_expandtabs(PyObject *self, PyObject *args)
}
}
if ((i + j) < 0) {
/* XXX: this depends on a signed integer overflow to < 0 */
/* C compilers, including gcc, do -NOT- guarantee this. */
if ((i + j) > PY_SSIZE_T_MAX) {
PyErr_SetString(PyExc_OverflowError, "result is too long");
return NULL;
}