traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Issue #18427: str.replace could crash the interpreter with huge strings. 

This fixes two places where 'int'  was used to represent
the size of strings, instead of 'Py_ssize_t'.

(The issue is not present in the corresponding code in the 3.x branches)

Fixes #18427
This commit is contained in:
Ronald Oussoren 2013-07-11 13:33:55 +02:00
parent f7c8584545
commit 3687e8055c
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Misc/NEWS
View File

@ -24,6 +24,8 @@ Core and Builtins
Library Library
------- -------
- Issue #18427: str.replace could crash the interpreter with huge strings.
- Issue #18347: ElementTree's html serializer now preserves the case of - Issue #18347: ElementTree's html serializer now preserves the case of
closing tags. closing tags.
@ -88,7 +90,7 @@ IDLE
- Issue #7136: In the Idle File menu, "New Window" is renamed "New File". - Issue #7136: In the Idle File menu, "New Window" is renamed "New File".
Patch by Tal Einat, Roget Serwy, and Todd Rovito. Patch by Tal Einat, Roget Serwy, and Todd Rovito.
- Issue #8515: Set __file__ when run file in IDLE. - Issue #8515: Set __file__ when run file in IDLE.
Initial patch by Bruce Frederiksen. Initial patch by Bruce Frederiksen.

6
Objects/stringobject.c
View File

@ -882,9 +882,9 @@ string_print(PyStringObject *op, FILE *fp, int flags)
size -= chunk_size; size -= chunk_size;
} }
#ifdef __VMS #ifdef __VMS
if (size) fwrite(data, (int)size, 1, fp); if (size) fwrite(data, (size_t)size, 1, fp);
#else #else
fwrite(data, 1, (int)size, fp); fwrite(data, 1, (size_t)size, fp);
#endif #endif
Py_END_ALLOW_THREADS Py_END_ALLOW_THREADS
return 0; return 0;
@ -2332,7 +2332,7 @@ return_self(PyStringObject *self)
} }
Py_LOCAL_INLINE(Py_ssize_t) Py_LOCAL_INLINE(Py_ssize_t)
countchar(const char *target, int target_len, char c, Py_ssize_t maxcount) countchar(const char *target, Py_ssize_t target_len, char c, Py_ssize_t maxcount)
{ {
Py_ssize_t count=0; Py_ssize_t count=0;
const char *start=target; const char *start=target;