diff options
| author | Miro Hrončok <miro@hroncok.cz> | 2017-12-08 21:34:12 (GMT) |
|---|---|---|
| committer | larryhastings <larry@hastings.org> | 2017-12-08 21:34:12 (GMT) |
| commit | fd8614c5c5466a14a945db5b059c10c0fb8f76d9 (patch) | |
| tree | 29521b03455c9be97055427be9a1b33cc279a99d | |
| parent | dcb101e7f078f12fc3d2bf1730410798a880bfe3 (diff) | |
| download | cpython-fd8614c5c5466a14a945db5b059c10c0fb8f76d9.zip cpython-fd8614c5c5466a14a945db5b059c10c0fb8f76d9.tar.gz cpython-fd8614c5c5466a14a945db5b059c10c0fb8f76d9.tar.bz2 | |
bpo-30657: Fix CVE-2017-1000158 (#4664)
Fixes possible integer overflow in PyBytes_DecodeEscape.
Co-Authored-By: Jay Bosamiya <jaybosamiya@gmail.com>
| -rw-r--r-- | Misc/ACKS | 2 | ||||
| -rw-r--r-- | Misc/NEWS.d/next/Security/2017-12-01-18-51-03.bpo-30657.Fd8kId.rst | 2 | ||||
| -rw-r--r-- | Objects/bytesobject.c | 8 |
3 files changed, 11 insertions, 1 deletions
@@ -167,6 +167,7 @@ Médéric Boquien Matias Bordese Jonas Borgström Jurjen Bos +Jay Bosamiya Peter Bosch Dan Boswell Eric Bouck @@ -651,6 +652,7 @@ Ken Howard Brad Howes Mike Hoy Ben Hoyt +Miro Hrončok Chiu-Hsiang Hsu Chih-Hao Huang Christian Hudon diff --git a/Misc/NEWS.d/next/Security/2017-12-01-18-51-03.bpo-30657.Fd8kId.rst b/Misc/NEWS.d/next/Security/2017-12-01-18-51-03.bpo-30657.Fd8kId.rst new file mode 100644 index 0000000..75359b6 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2017-12-01-18-51-03.bpo-30657.Fd8kId.rst @@ -0,0 +1,2 @@ +Fixed possible integer overflow in PyBytes_DecodeEscape, CVE-2017-1000158. +Original patch by Jay Bosamiya; rebased to Python 3 by Miro Hrončok. diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c index 77dd45e..9b29dc3 100644 --- a/Objects/bytesobject.c +++ b/Objects/bytesobject.c @@ -970,7 +970,13 @@ PyObject *PyBytes_DecodeEscape(const char *s, char *p, *buf; const char *end; PyObject *v; - Py_ssize_t newlen = recode_encoding ? 4*len:len; + Py_ssize_t newlen; + /* Check for integer overflow */ + if (recode_encoding && (len > PY_SSIZE_T_MAX / 4)) { + PyErr_SetString(PyExc_OverflowError, "string is too large"); + return NULL; + } + newlen = recode_encoding ? 4*len:len; v = PyBytes_FromStringAndSize((char *)NULL, newlen); if (v == NULL) return NULL; |