From 99b5afab74428e5ddfd877bdf3aa8a8c479696b1 Mon Sep 17 00:00:00 2001 From: Benjamin Peterson Date: Sun, 13 Apr 2014 22:10:38 -0400 Subject: [PATCH] in scan_once, prevent the reading of arbitrary memory when passed a negative index Bug reported by Guido Vranken. --- Lib/test/json_tests/test_decode.py | 4 ++++ Misc/ACKS | 1 + Misc/NEWS | 3 +++ Modules/_json.c | 5 ++++- 4 files changed, 12 insertions(+), 1 deletion(-) diff --git a/Lib/test/json_tests/test_decode.py b/Lib/test/json_tests/test_decode.py index 15a427f719b..a3d7b088837 100644 --- a/Lib/test/json_tests/test_decode.py +++ b/Lib/test/json_tests/test_decode.py @@ -70,5 +70,9 @@ class TestDecode: msg = 'escape' self.assertRaisesRegex(ValueError, msg, self.loads, s) + def test_negative_index(self): + d = self.json.JSONDecoder() + self.assertRaises(ValueError, d.raw_decode, 'a'*42, -50000) + class TestPyDecode(TestDecode, PyTest): pass class TestCDecode(TestDecode, CTest): pass diff --git a/Misc/ACKS b/Misc/ACKS index b95047497e1..a9320749754 100644 --- a/Misc/ACKS +++ b/Misc/ACKS @@ -1139,6 +1139,7 @@ Frank Visser Johannes Vogel Martijn Vries Sjoerd de Vries +Guido Vranken Niki W. Waibel Wojtek Walczak Charles Waldman diff --git a/Misc/NEWS b/Misc/NEWS index 3913f94956f..e44219a9d7f 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -10,6 +10,9 @@ What's New in Python 3.2.6? Library ------- +- Fix arbitrary memory access in JSONDecoder.raw_decode with a negative second + parameter. Bug reported by Guido Vranken. + - Issue #21082: In os.makedirs, do not set the process-wide umask. Note this changes behavior of makedirs when exist_ok=True. diff --git a/Modules/_json.c b/Modules/_json.c index 01436b6950a..5bd52cb7898 100644 --- a/Modules/_json.c +++ b/Modules/_json.c @@ -930,7 +930,10 @@ scan_once_unicode(PyScannerObject *s, PyObject *pystr, Py_ssize_t idx, Py_ssize_ PyObject *res; Py_UNICODE *str = PyUnicode_AS_UNICODE(pystr); Py_ssize_t length = PyUnicode_GET_SIZE(pystr); - if (idx >= length) { + if (idx < 0) + /* Compatibility with Python version. */ + idx += length; + if (idx < 0 || idx >= length) { PyErr_SetNone(PyExc_StopIteration); return NULL; }