traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

bpo-24618: Add a check in the code constructor. (GH-8283) 

Check that the size of the varnames tuple is enough at least for all arguments.
This commit is contained in:
Serhiy Storchaka 2018-07-16 09:10:19 +03:00 committed by GitHub
parent 15c7b2abdf
commit bd47384e07
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Misc/NEWS.d/next/Core and Builtins/2018-07-14-14-01-37.bpo-24618.iTKjD_.rst Normal file
View File

@ -0,0 +1,2 @@
Fixed reading invalid memory when create the code object with too small
varnames tuple or too large argument counts.

18
Objects/codeobject.c
View File

@ -103,7 +103,7 @@ PyCode_New(int argcount, int kwonlyargcount,
{
PyCodeObject *co;
Py_ssize_t *cell2arg = NULL;
Py_ssize_t i, n_cellvars;
Py_ssize_t i, n_cellvars, n_varnames, total_args;
/* Check argument types */
if (argcount < 0 || kwonlyargcount < 0 || nlocals < 0 ||
@ -138,10 +138,22 @@ PyCode_New(int argcount, int kwonlyargcount,
flags &= ~CO_NOFREE;
}
n_varnames = PyTuple_GET_SIZE(varnames);
if (argcount <= n_varnames && kwonlyargcount <= n_varnames) {
/* Never overflows. */
total_args = (Py_ssize_t)argcount + (Py_ssize_t)kwonlyargcount +
((flags & CO_VARARGS) != 0) + ((flags & CO_VARKEYWORDS) != 0);
}
else {
total_args = n_varnames + 1;
}
if (total_args > n_varnames) {
PyErr_SetString(PyExc_ValueError, "code: varnames is too small");
return NULL;
}
/* Create mapping between cells and arguments if needed. */
if (n_cellvars) {
Py_ssize_t total_args = argcount + kwonlyargcount +
((flags & CO_VARARGS) != 0) + ((flags & CO_VARKEYWORDS) != 0);
bool used_cell2arg = false;
cell2arg = PyMem_NEW(Py_ssize_t, n_cellvars);
if (cell2arg == NULL) {