diff options
author | Benjamin Peterson <benjamin@python.org> | 2014-04-14 02:28:16 (GMT) |
---|---|---|
committer | Benjamin Peterson <benjamin@python.org> | 2014-04-14 02:28:16 (GMT) |
commit | 156285c35f8ff856883f09394653b000331e3e33 (patch) | |
tree | 76fe7455051296fdbb57ced15fb20ec7d321c4ce | |
parent | f5c34054f9ea1fbdaeafdcf1a6f17f64f4dfed63 (diff) | |
parent | 99b5afab74428e5ddfd877bdf3aa8a8c479696b1 (diff) | |
download | cpython-156285c35f8ff856883f09394653b000331e3e33.zip cpython-156285c35f8ff856883f09394653b000331e3e33.tar.gz cpython-156285c35f8ff856883f09394653b000331e3e33.tar.bz2 |
merge 3.2
-rw-r--r-- | Lib/test/test_json/test_decode.py | 4 | ||||
-rw-r--r-- | Misc/ACKS | 1 | ||||
-rw-r--r-- | Misc/NEWS | 3 | ||||
-rw-r--r-- | Modules/_json.c | 5 |
4 files changed, 12 insertions, 1 deletions
diff --git a/Lib/test/test_json/test_decode.py b/Lib/test/test_json/test_decode.py index d23e285..17245eb 100644 --- a/Lib/test/test_json/test_decode.py +++ b/Lib/test/test_json/test_decode.py @@ -70,5 +70,9 @@ class TestDecode: msg = 'escape' self.assertRaisesRegex(ValueError, msg, self.loads, s) + def test_negative_index(self): + d = self.json.JSONDecoder() + self.assertRaises(ValueError, d.raw_decode, 'a'*42, -50000) + class TestPyDecode(TestDecode, PyTest): pass class TestCDecode(TestDecode, CTest): pass @@ -1313,6 +1313,7 @@ Johannes Vogel Alex Volkov Martijn Vries Sjoerd de Vries +Guido Vranken Niki W. Waibel Wojtek Walczak Charles Waldman @@ -13,6 +13,9 @@ Core and Builtins Library ------- +- Fix arbitrary memory access in JSONDecoder.raw_decode with a negative second + parameter. Bug reported by Guido Vranken. + - Issue #20633: Replace relative import by absolute import. - Issue #21082: In os.makedirs, do not set the process-wide umask. Note this diff --git a/Modules/_json.c b/Modules/_json.c index 9166680..ec980c9 100644 --- a/Modules/_json.c +++ b/Modules/_json.c @@ -975,7 +975,10 @@ scan_once_unicode(PyScannerObject *s, PyObject *pystr, Py_ssize_t idx, Py_ssize_ kind = PyUnicode_KIND(pystr); length = PyUnicode_GET_LENGTH(pystr); - if (idx >= length) { + if (idx < 0) + /* Compatibility with Python version. */ + idx += length; + if (idx < 0 || idx >= length) { PyErr_SetNone(PyExc_StopIteration); return NULL; } |