summaryrefslogtreecommitdiffstats
path: root/Lib/dbm
diff options
context:
space:
mode:
authorSerhiy Storchaka <storchaka@gmail.com>2015-02-15 22:30:43 (GMT)
committerSerhiy Storchaka <storchaka@gmail.com>2015-02-15 22:30:43 (GMT)
commit74eb8b2d1a1db905cffc4efcd1cefaf1f725cd81 (patch)
tree55874458c25a5c5cf90ce30a120ce50f9cc43f62 /Lib/dbm
parent57fffd6f99d55ccd623b381622b989410a695b99 (diff)
downloadcpython-74eb8b2d1a1db905cffc4efcd1cefaf1f725cd81.zip
cpython-74eb8b2d1a1db905cffc4efcd1cefaf1f725cd81.tar.gz
cpython-74eb8b2d1a1db905cffc4efcd1cefaf1f725cd81.tar.bz2
Issue #22885: Fixed arbitrary code execution vulnerability in the dbm.dumb
module. Original patch by Claudiu Popa.
Diffstat (limited to 'Lib/dbm')
-rw-r--r--Lib/dbm/dumb.py3
1 files changed, 2 insertions, 1 deletions
diff --git a/Lib/dbm/dumb.py b/Lib/dbm/dumb.py
index 8f48aad..a9ead68 100644
--- a/Lib/dbm/dumb.py
+++ b/Lib/dbm/dumb.py
@@ -21,6 +21,7 @@ is read when the database is opened, and some updates rewrite the whole index)
"""
+import ast as _ast
import io as _io
import os as _os
import collections
@@ -85,7 +86,7 @@ class _Database(collections.MutableMapping):
with f:
for line in f:
line = line.rstrip()
- key, pos_and_siz_pair = eval(line)
+ key, pos_and_siz_pair = _ast.literal_eval(line)
key = key.encode('Latin-1')
self._index[key] = pos_and_siz_pair