diff options
| author | Victor Stinner <victor.stinner@gmail.com> | 2016-05-20 19:16:59 (GMT) |
|---|---|---|
| committer | Victor Stinner <victor.stinner@gmail.com> | 2016-05-20 19:16:59 (GMT) |
| commit | da23056a3ed33d2ae69752f7d113059333176297 (patch) | |
| tree | 33f88aab0e971f9c053cb6a6bf0f7444412542c6 | |
| parent | f4049ee1700936a28494e0da607131bde62a8fe5 (diff) | |
| download | cpython-da23056a3ed33d2ae69752f7d113059333176297.zip cpython-da23056a3ed33d2ae69752f7d113059333176297.tar.gz cpython-da23056a3ed33d2ae69752f7d113059333176297.tar.bz2 | |
Issue #27056: Fix _Unpickler_Read() to avoid integer overflow
| -rw-r--r-- | Modules/_pickle.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/Modules/_pickle.c b/Modules/_pickle.c index e3aa7c5..1c9b9eb 100644 --- a/Modules/_pickle.c +++ b/Modules/_pickle.c @@ -1244,7 +1244,7 @@ _Unpickler_ReadImpl(UnpicklerObject *self, char **s, Py_ssize_t n) Returns -1 (with an exception set) on failure. On success, return the number of chars read. */ #define _Unpickler_Read(self, s, n) \ - (((self)->next_read_idx + (n) <= (self)->input_len) \ + (((n) <= (self)->input_len - (self)->next_read_idx) \ ? (*(s) = (self)->input_buffer + (self)->next_read_idx, \ (self)->next_read_idx += (n), \ (n)) \ |