traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

bpo-33016: Fix potential use of uninitialized memory in nt._getfinalpathname (GH-6010) 

(cherry picked from commit 3b20d3454e)

Co-authored-by: Alexey Izbyshev <izbyshev@users.noreply.github.com>
This commit is contained in:
Miss Islington (bot) 2018-03-08 08:26:43 -08:00 committed by GitHub
parent e724dd4e5e
commit 8c163bbf37
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 34 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Misc/NEWS.d/next/Windows/2018-03-07-01-33-33.bpo-33016.Z_Med0.rst Normal file
View File

@ -0,0 +1 @@
Fix potential use of uninitialized memory in nt._getfinalpathname

76
Modules/posixmodule.c
View File

@ -303,12 +303,6 @@ extern int lstat(const char *, struct stat *);
#ifdef HAVE_PROCESS_H
#include <process.h>
#endif
#ifndef VOLUME_NAME_DOS
#define VOLUME_NAME_DOS 0x0
#endif
#ifndef VOLUME_NAME_NT
#define VOLUME_NAME_NT 0x2
#endif
#ifndef IO_REPARSE_TAG_SYMLINK
#define IO_REPARSE_TAG_SYMLINK (0xA000000CL)
#endif
@ -3731,11 +3725,10 @@ os__getfinalpathname_impl(PyObject *module, path_t *path)
/*[clinic end generated code: output=621a3c79bc29ebfa input=2b6b6c7cbad5fb84]*/
{
HANDLE hFile;
int buf_size;
wchar_t *target_path;
wchar_t buf[MAXPATHLEN], *target_path = buf;
int buf_size = Py_ARRAY_LENGTH(buf);
int result_length;
PyObject *result;
const char *err = NULL;
Py_BEGIN_ALLOW_THREADS
hFile = CreateFileW(
@ -3747,55 +3740,52 @@ os__getfinalpathname_impl(PyObject *module, path_t *path)
/* FILE_FLAG_BACKUP_SEMANTICS is required to open a directory */
FILE_FLAG_BACKUP_SEMANTICS,
NULL);
Py_END_ALLOW_THREADS
if (hFile == INVALID_HANDLE_VALUE) {
err = "CreateFileW";
goto done1;
return win32_error_object("CreateFileW", path->object);
}
/* We have a good handle to the target, use it to determine the
target path name. */
buf_size = GetFinalPathNameByHandleW(hFile, 0, 0, VOLUME_NAME_NT);
while (1) {
Py_BEGIN_ALLOW_THREADS
result_length = GetFinalPathNameByHandleW(hFile, target_path,
buf_size, VOLUME_NAME_DOS);
Py_END_ALLOW_THREADS
if (!buf_size) {
err = "GetFinalPathNameByHandle";
goto done1;
}
done1:
Py_END_ALLOW_THREADS
if (err)
return win32_error_object(err, path->object);
if (!result_length) {
result = win32_error_object("GetFinalPathNameByHandleW",
path->object);
goto cleanup;
}
target_path = PyMem_New(wchar_t, buf_size+1);
if(!target_path)
return PyErr_NoMemory();
if (result_length < buf_size) {
break;
}
Py_BEGIN_ALLOW_THREADS
result_length = GetFinalPathNameByHandleW(hFile, target_path,
buf_size, VOLUME_NAME_DOS);
if (!result_length) {
err = "GetFinalPathNameByHandle";
goto done2;
wchar_t *tmp;
tmp = PyMem_Realloc(target_path != buf ? target_path : NULL,
result_length * sizeof(*tmp));
if (!tmp) {
result = PyErr_NoMemory();
goto cleanup;
}
buf_size = result_length;
target_path = tmp;
}
if (!CloseHandle(hFile)) {
err = "CloseHandle";
goto done2;
}
done2:
Py_END_ALLOW_THREADS
if (err) {
PyMem_Free(target_path);
return win32_error_object(err, path->object);
}
target_path[result_length] = 0;
result = PyUnicode_FromWideChar(target_path, result_length);
PyMem_Free(target_path);
if (path->narrow)
Py_SETREF(result, PyUnicode_EncodeFSDefault(result));
return result;
cleanup:
if (target_path != buf) {
PyMem_Free(target_path);
}
CloseHandle(hFile);
return result;
}
/*[clinic input]