diff options
| author | Benjamin Peterson <benjamin@python.org> | 2014-01-14 04:14:42 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2014-01-14 04:14:42 (GMT) |
| commit | c6b37e21f513e056b06013a432be715937a27861 (patch) | |
| tree | 66264fd38241846b2d9ed4448e92f854bf450ae5 | |
| parent | e74f96ded523fb2fbe977c90093f711ae6bc3d2c (diff) | |
| download | cpython-c6b37e21f513e056b06013a432be715937a27861.zip cpython-c6b37e21f513e056b06013a432be715937a27861.tar.gz cpython-c6b37e21f513e056b06013a432be715937a27861.tar.bz2 | |
merge 3.3 (#20246)
| -rw-r--r-- | Lib/test/test_socket.py | 8 | ||||
| -rw-r--r-- | Misc/ACKS | 1 | ||||
| -rw-r--r-- | Misc/NEWS | 2 | ||||
| -rw-r--r-- | Modules/socketmodule.c | 5 |
4 files changed, 16 insertions, 0 deletions
diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py index bf42432..cce412a 100644 --- a/Lib/test/test_socket.py +++ b/Lib/test/test_socket.py @@ -4683,6 +4683,14 @@ class BufferIOTest(SocketConnectedTest): _testRecvFromIntoMemoryview = _testRecvFromIntoArray + def testRecvFromIntoSmallBuffer(self): + # See issue #20246. + buf = bytearray(8) + self.assertRaises(ValueError, self.cli_conn.recvfrom_into, buf, 1024) + + def _testRecvFromIntoSmallBuffer(self): + self.serv_conn.send(MSG*2048) + TIPC_STYPE = 2000 TIPC_LOWER = 200 @@ -1218,6 +1218,7 @@ Eric V. Smith Gregory P. Smith Mark Smith Roy Smith +Ryan Smith-Roberts Rafal Smotrzyk Eric Snow Dirk Soede @@ -28,6 +28,8 @@ Library - Issue #20242: Fixed basicConfig() format strings for the alternative formatting styles. Thanks to kespindler for the bug report and patch. +- Issue #20246: Fix buffer overflow in socket.recvfrom_into. + - Issues #20206 and #5803: Fix edge case in email.quoprimime.encode where it truncated lines ending in a character needing encoding but no newline by using a more efficient algorithm that doesn't have the bug. diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c index 6c229bc..9cc317f 100644 --- a/Modules/socketmodule.c +++ b/Modules/socketmodule.c @@ -2875,6 +2875,11 @@ sock_recvfrom_into(PySocketSockObject *s, PyObject *args, PyObject* kwds) if (recvlen == 0) { /* If nbytes was not specified, use the buffer's length */ recvlen = buflen; + } else if (recvlen > buflen) { + PyBuffer_Release(&pbuf); + PyErr_SetString(PyExc_ValueError, + "nbytes is greater than the length of the buffer"); + return NULL; } readlen = sock_recvfrom_guts(s, buf, recvlen, flags, &addr); |