diff options
| author | Berker Peksag <berker.peksag@gmail.com> | 2016-09-14 05:37:28 (GMT) |
|---|---|---|
| committer | Berker Peksag <berker.peksag@gmail.com> | 2016-09-14 05:37:28 (GMT) |
| commit | d751040b1a4e35fd3b01fc919cd8f9374ed714fd (patch) | |
| tree | e66351e1ef0874fa681d4b4699eb61743c765300 | |
| parent | 1f0e7c99331750d1683287218cbab99dc26b2b83 (diff) | |
| download | cpython-d751040b1a4e35fd3b01fc919cd8f9374ed714fd.zip cpython-d751040b1a4e35fd3b01fc919cd8f9374ed714fd.tar.gz cpython-d751040b1a4e35fd3b01fc919cd8f9374ed714fd.tar.bz2 | |
Issue #26171: Prevent buffer overflow in get_data
Backport of 01ddd608b85c.
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Modules/zipimport.c | 5 |
2 files changed, 8 insertions, 0 deletions
@@ -10,6 +10,9 @@ What's New in Python 3.3.7? Core and Builtins ----------------- +- Issue #26171: Fix possible integer overflow and heap corruption in + zipimporter.get_data(). + - Issue #25709: Fixed problem with in-place string concatenation and utf-8 cache. - Issue #24407: Fix crash when dict is mutated while being updated. diff --git a/Modules/zipimport.c b/Modules/zipimport.c index 2feb2a8..dad699e 100644 --- a/Modules/zipimport.c +++ b/Modules/zipimport.c @@ -1089,6 +1089,11 @@ get_data(PyObject *archive, PyObject *toc_entry) PyMarshal_ReadShortFromFile(fp); /* local header size */ file_offset += l; /* Start of file data */ + if (data_size > LONG_MAX - 1) { + fclose(fp); + PyErr_NoMemory(); + return NULL; + } bytes_size = compress == 0 ? data_size : data_size + 1; if (bytes_size == 0) bytes_size++; |