diff options
| author | Serhiy Storchaka <storchaka@gmail.com> | 2015-02-15 22:30:43 (GMT) |
|---|---|---|
| committer | Serhiy Storchaka <storchaka@gmail.com> | 2015-02-15 22:30:43 (GMT) |
| commit | 74eb8b2d1a1db905cffc4efcd1cefaf1f725cd81 (patch) | |
| tree | 55874458c25a5c5cf90ce30a120ce50f9cc43f62 /Lib/dbm | |
| parent | 57fffd6f99d55ccd623b381622b989410a695b99 (diff) | |
| download | cpython-74eb8b2d1a1db905cffc4efcd1cefaf1f725cd81.zip cpython-74eb8b2d1a1db905cffc4efcd1cefaf1f725cd81.tar.gz cpython-74eb8b2d1a1db905cffc4efcd1cefaf1f725cd81.tar.bz2 | |
Issue #22885: Fixed arbitrary code execution vulnerability in the dbm.dumb
module. Original patch by Claudiu Popa.
Diffstat (limited to 'Lib/dbm')
| -rw-r--r-- | Lib/dbm/dumb.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/Lib/dbm/dumb.py b/Lib/dbm/dumb.py index 8f48aad..a9ead68 100644 --- a/Lib/dbm/dumb.py +++ b/Lib/dbm/dumb.py @@ -21,6 +21,7 @@ is read when the database is opened, and some updates rewrite the whole index) """ +import ast as _ast import io as _io import os as _os import collections @@ -85,7 +86,7 @@ class _Database(collections.MutableMapping): with f: for line in f: line = line.rstrip() - key, pos_and_siz_pair = eval(line) + key, pos_and_siz_pair = _ast.literal_eval(line) key = key.encode('Latin-1') self._index[key] = pos_and_siz_pair |