diff options
| author | Benjamin Peterson <benjamin@python.org> | 2016-01-21 06:25:40 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2016-01-21 06:25:40 (GMT) |
| commit | 2b0b5ac5a0935dd0deb30c129fc117640d409ac6 (patch) | |
| tree | e3d79d33835228062ab8340610f0d668bddb6b90 | |
| parent | ba77788bba7ab0b8e2ea50f2c3b30a471b18f941 (diff) | |
| parent | 47b8ba22e304fa136563c803f5f0cc589e8be1ac (diff) | |
| download | cpython-2b0b5ac5a0935dd0deb30c129fc117640d409ac6.zip cpython-2b0b5ac5a0935dd0deb30c129fc117640d409ac6.tar.gz cpython-2b0b5ac5a0935dd0deb30c129fc117640d409ac6.tar.bz2 | |
merge 3.5 (#26171)
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Modules/zipimport.c | 5 |
2 files changed, 8 insertions, 0 deletions
@@ -140,6 +140,9 @@ Core and Builtins converted to normal strings at run time. Given x=3, then f'value={x}' == 'value=3'. Patch by Eric V. Smith. +- Issue #26171: Fix possible integer overflow and heap corruption in + zipimporter.get_data(). + Library ------- diff --git a/Modules/zipimport.c b/Modules/zipimport.c index aa6493a..78cf398 100644 --- a/Modules/zipimport.c +++ b/Modules/zipimport.c @@ -1127,6 +1127,11 @@ get_data(PyObject *archive, PyObject *toc_entry) } file_offset += l; /* Start of file data */ + if (data_size > LONG_MAX - 1) { + fclose(fp); + PyErr_NoMemory(); + return NULL; + } bytes_size = compress == 0 ? data_size : data_size + 1; if (bytes_size == 0) bytes_size++; |