traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

bpo-41524: fix pointer bug in PyOS_mystr{n}icmp (GH-21845) 

* bpo-41524: fix pointer bug in PyOS_mystr{n}icmp

The existing implementations of PyOS_mystrnicmp and PyOS_mystricmp
can increment pointers beyond the end of a string.

This commit fixes those cases by moving the mutation out of the condition.

* 📜🤖 Added by blurb_it.

* Address comments

Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
This commit is contained in:
wmeehan 2020-08-27 01:45:25 -04:00 committed by GitHub
parent 022bc7572f
commit 97eaf2b5e5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Misc/NEWS.d/next/C API/2020-08-12-17-09-06.bpo-41524.u6Xfr2.rst Normal file
View File

@ -0,0 +1,2 @@
Fix bug in PyOS_mystrnicmp and PyOS_mystricmp that incremented
pointers beyond the end of a string.

18
Python/pystrcmp.c
View File

@ -6,21 +6,25 @@
int int
PyOS_mystrnicmp(const char *s1, const char *s2, Py_ssize_t size) PyOS_mystrnicmp(const char *s1, const char *s2, Py_ssize_t size)
{ {
const unsigned char *p1, *p2;
if (size == 0) if (size == 0)
return 0; return 0;
while ((--size > 0) && p1 = (const unsigned char *)s1;
(tolower((unsigned)*s1) == tolower((unsigned)*s2))) { p2 = (const unsigned char *)s2;
if (!*s1++ || !*s2++) for (; (--size > 0) && *p1 && *p2 && (tolower(*p1) == tolower(*p2));
break; p1++, p2++) {
;
} }
return tolower((unsigned)*s1) - tolower((unsigned)*s2); return tolower(*p1) - tolower(*p2);
} }
int int
PyOS_mystricmp(const char *s1, const char *s2) PyOS_mystricmp(const char *s1, const char *s2)
{ {
while (*s1 && (tolower((unsigned)*s1++) == tolower((unsigned)*s2++))) { const unsigned char *p1 = (const unsigned char *)s1;
const unsigned char *p2 = (const unsigned char *)s2;
for (; *p1 && *p2 && (tolower(*p1) == tolower(*p2)); p1++, p2++) {
; ;
} }
return (tolower((unsigned)*s1) - tolower((unsigned)*s2)); return (tolower(*p1) - tolower(*p2));
} }