traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

In PySlice_IndicesEx, clip the step to [-PY_SSIZE_T_MAX, PY_SSIZE_T_MAX] rather than [PY_SSIZE_T_MIN, PY_SSIZE_T_MAX].

This commit is contained in:
Mark Dickinson 2010-08-06 18:55:26 +00:00
parent af5ac3974b
commit e6fc7401a9
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Misc/NEWS
View File

@ -529,6 +529,10 @@ Core and Builtins
C-API C-API
----- -----
- PySlice_GetIndicesEx now clips the step to [-PY_SSIZE_T_MAX, PY_SSIZE_T_MAX]
instead of [-PY_SSIZE_T_MAX-1, PY_SSIZE_T_MAX]. This makes it safe to do
"step = -step" when reversing a slice.
- Issue #5753: A new C API function, `PySys_SetArgvEx`, allows embedders of the - Issue #5753: A new C API function, `PySys_SetArgvEx`, allows embedders of the
interpreter to set sys.argv without also modifying sys.path. This helps fix interpreter to set sys.argv without also modifying sys.path. This helps fix
`CVE-2008-5983 `CVE-2008-5983

10
Objects/sliceobject.c
View File

@ -131,7 +131,8 @@ PySlice_GetIndices(PySliceObject *r, Py_ssize_t length,
int int
PySlice_GetIndicesEx(PySliceObject *r, Py_ssize_t length, PySlice_GetIndicesEx(PySliceObject *r, Py_ssize_t length,
Py_ssize_t *start, Py_ssize_t *stop, Py_ssize_t *step, Py_ssize_t *slicelength) Py_ssize_t *start, Py_ssize_t *stop, Py_ssize_t *step,
Py_ssize_t *slicelength)
{ {
/* this is harder to get right than you might think */ /* this is harder to get right than you might think */
@ -147,6 +148,13 @@ PySlice_GetIndicesEx(PySliceObject *r, Py_ssize_t length,
"slice step cannot be zero"); "slice step cannot be zero");
return -1; return -1;
} }
/* Here *step might be -PY_SSIZE_T_MAX-1; in this case we replace it
* with -PY_SSIZE_T_MAX. This doesn't affect the semantics, and it
* guards against later undefined behaviour resulting from code that
* does "step = -step" as part of a slice reversal.
*/
if (*step < -PY_SSIZE_T_MAX)
*step = -PY_SSIZE_T_MAX;
} }
defstart = *step < 0 ? length-1 : 0; defstart = *step < 0 ? length-1 : 0;