diff options
| author | Tim Peters <tim.peters@gmail.com> | 2004-08-08 01:00:47 (GMT) |
|---|---|---|
| committer | Tim Peters <tim.peters@gmail.com> | 2004-08-08 01:00:47 (GMT) |
| commit | ec8c5a931136b61231b295f2aded8dc04035e9b7 (patch) | |
| tree | 76a240b7d477eb976027695d05b116037afe3873 /Lib/urllib2.py | |
| parent | 95334a5d1e224548d16b358c1314be444625b925 (diff) | |
| download | cpython-ec8c5a931136b61231b295f2aded8dc04035e9b7.zip cpython-ec8c5a931136b61231b295f2aded8dc04035e9b7.tar.gz cpython-ec8c5a931136b61231b295f2aded8dc04035e9b7.tar.bz2 | |
Bug 1003471: Python 1.5.2 security vulnerability still present in 2.3.4
That's the title of the report, but the hole was probably plugged since
Python 2.0. See corresponding checkin to PC/getpathp.c: a crucial
precondition for joinpath() was neither documented nor verified, and there
are so many callers with so many conditional paths that no "eyeball
analysis" is satisfactory. Now Python dies with a fatal error if the
precondition isn't satisfied, instead of allowing a buffer overrun.
NOT TESTED! The Windows version of the patch was, but not this one. I
don't feel like waiting for someone to notice the patch I attached to the
bug report. If it doesn't compile, sorry, but fix it <wink>. If it
does compile, it's "obviously correct".
Diffstat (limited to 'Lib/urllib2.py')
0 files changed, 0 insertions, 0 deletions