diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2011-08-29 22:28:40 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2011-08-29 22:28:40 (GMT) |
| commit | a514eb95f30306a11a14f8a3b9cbf229c6af6137 (patch) | |
| tree | 9448e0e80659d32aa1c11e78c905e21a87ca320d /Lib/pickle.py | |
| parent | ee763e2acc469fa2f423440517b9bc227fbbe79c (diff) | |
| parent | 55549ec476c178ca4723ba97d4f00a015f427427 (diff) | |
| download | cpython-a514eb95f30306a11a14f8a3b9cbf229c6af6137.zip cpython-a514eb95f30306a11a14f8a3b9cbf229c6af6137.tar.gz cpython-a514eb95f30306a11a14f8a3b9cbf229c6af6137.tar.bz2 | |
Issue #12847: Fix a crash with negative PUT and LONG_BINPUT arguments in
the C pickle implementation.
Diffstat (limited to 'Lib/pickle.py')
| -rw-r--r-- | Lib/pickle.py | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/Lib/pickle.py b/Lib/pickle.py index fdeadee..0aee77a 100644 --- a/Lib/pickle.py +++ b/Lib/pickle.py @@ -1154,16 +1154,22 @@ class _Unpickler: def load_put(self): i = int(self.readline()[:-1]) + if i < 0: + raise ValueError("negative PUT argument") self.memo[i] = self.stack[-1] dispatch[PUT[0]] = load_put def load_binput(self): i = self.read(1)[0] + if i < 0: + raise ValueError("negative BINPUT argument") self.memo[i] = self.stack[-1] dispatch[BINPUT[0]] = load_binput def load_long_binput(self): i = mloads(b'i' + self.read(4)) + if i < 0: + raise ValueError("negative LONG_BINPUT argument") self.memo[i] = self.stack[-1] dispatch[LONG_BINPUT[0]] = load_long_binput |