traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge #14398: Fix size truncation and overflow bugs in bz2 module.

This commit is contained in:
Nadeem Vawda 2012-10-21 21:16:58 +02:00
parent 550841253f 5f8f0d6777
commit 18b7fcc7a6
2 changed files with 26 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Misc/NEWS
View File

@ -46,6 +46,8 @@ Core and Builtins
Library
-------
- Issue #14398: Fix size truncation and overflow bugs in the bz2 module.
- Issue #16220: wsgiref now always calls close() on an iterable response.
Patch by Brent Tubbs.

33
Modules/_bz2module.c
View File

@ -123,7 +123,14 @@ grow_buffer(PyObject **buf)
giving us amortized linear-time behavior. Use a less-than-double
growth factor to avoid excessive allocation. */
size_t size = PyBytes_GET_SIZE(*buf);
return _PyBytes_Resize(buf, size + (size >> 3) + 6);
size_t new_size = size + (size >> 3) + 6;
if (new_size > size) {
return _PyBytes_Resize(buf, new_size);
} else { /* overflow */
PyErr_SetString(PyExc_OverflowError,
"Unable to allocate buffer - output too large");
return -1;
}
}
@ -169,10 +176,14 @@ compress(BZ2Compressor *c, char *data, size_t len, int action)
break;
if (c->bzs.avail_out == 0) {
if (grow_buffer(&result) < 0)
goto error;
c->bzs.next_out = PyBytes_AS_STRING(result) + data_size;
c->bzs.avail_out = PyBytes_GET_SIZE(result) - data_size;
size_t buffer_left = PyBytes_GET_SIZE(result) - data_size;
if (buffer_left == 0) {
if (grow_buffer(&result) < 0)
goto error;
c->bzs.next_out = PyBytes_AS_STRING(result) + data_size;
buffer_left = PyBytes_GET_SIZE(result) - data_size;
}
c->bzs.avail_out = MIN(buffer_left, UINT_MAX);
}
}
if (data_size != PyBytes_GET_SIZE(result))
@ -390,10 +401,14 @@ decompress(BZ2Decompressor *d, char *data, size_t len)
len -= d->bzs.avail_in;
}
if (d->bzs.avail_out == 0) {
if (grow_buffer(&result) < 0)
goto error;
d->bzs.next_out = PyBytes_AS_STRING(result) + data_size;
d->bzs.avail_out = PyBytes_GET_SIZE(result) - data_size;
size_t buffer_left = PyBytes_GET_SIZE(result) - data_size;
if (buffer_left == 0) {
if (grow_buffer(&result) < 0)
goto error;
d->bzs.next_out = PyBytes_AS_STRING(result) + data_size;
buffer_left = PyBytes_GET_SIZE(result) - data_size;
}
d->bzs.avail_out = MIN(buffer_left, UINT_MAX);
}
}
if (data_size != PyBytes_GET_SIZE(result))