diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2011-08-29 22:27:10 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2011-08-29 22:27:10 (GMT) |
| commit | 55549ec476c178ca4723ba97d4f00a015f427427 (patch) | |
| tree | 43dee50c756d4a81c23efcc254a703d6425d1fb2 /Lib/pickle.py | |
| parent | 82be19f889e97618d73f405ad53ceffbee462008 (diff) | |
| download | cpython-55549ec476c178ca4723ba97d4f00a015f427427.zip cpython-55549ec476c178ca4723ba97d4f00a015f427427.tar.gz cpython-55549ec476c178ca4723ba97d4f00a015f427427.tar.bz2 | |
Issue #12847: Fix a crash with negative PUT and LONG_BINPUT arguments in
the C pickle implementation.
Diffstat (limited to 'Lib/pickle.py')
| -rw-r--r-- | Lib/pickle.py | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/Lib/pickle.py b/Lib/pickle.py index aca8fd1..32ae02b 100644 --- a/Lib/pickle.py +++ b/Lib/pickle.py @@ -1156,16 +1156,22 @@ class _Unpickler: def load_put(self): i = int(self.readline()[:-1]) + if i < 0: + raise ValueError("negative PUT argument") self.memo[i] = self.stack[-1] dispatch[PUT[0]] = load_put def load_binput(self): i = self.read(1)[0] + if i < 0: + raise ValueError("negative BINPUT argument") self.memo[i] = self.stack[-1] dispatch[BINPUT[0]] = load_binput def load_long_binput(self): i = mloads(b'i' + self.read(4)) + if i < 0: + raise ValueError("negative LONG_BINPUT argument") self.memo[i] = self.stack[-1] dispatch[LONG_BINPUT[0]] = load_long_binput |