diff options
| author | Serhiy Storchaka <storchaka@gmail.com> | 2015-09-03 22:08:03 (GMT) |
|---|---|---|
| committer | Serhiy Storchaka <storchaka@gmail.com> | 2015-09-03 22:08:03 (GMT) |
| commit | 594e54c765c5d53b14547f30ee59018514d44698 (patch) | |
| tree | aa220989054a4aa1f31a7fd5b17f7e7884eb135f /Modules/_io | |
| parent | 5b6917e60d2ffc0a87a6a17c234ba143a480dd82 (diff) | |
| download | cpython-594e54c765c5d53b14547f30ee59018514d44698.zip cpython-594e54c765c5d53b14547f30ee59018514d44698.tar.gz cpython-594e54c765c5d53b14547f30ee59018514d44698.tar.bz2 | |
Issue #24989: Fixed buffer overread in BytesIO.readline() if a position is
set beyond size. Based on patch by John Leitch.
Diffstat (limited to 'Modules/_io')
| -rw-r--r-- | Modules/_io/bytesio.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/Modules/_io/bytesio.c b/Modules/_io/bytesio.c index d46430d..31cc1f7 100644 --- a/Modules/_io/bytesio.c +++ b/Modules/_io/bytesio.c @@ -57,14 +57,18 @@ scan_eol(bytesio *self, Py_ssize_t len) Py_ssize_t maxlen; assert(self->buf != NULL); + assert(self->pos >= 0); + + if (self->pos >= self->string_size) + return 0; /* Move to the end of the line, up to the end of the string, s. */ - start = PyBytes_AS_STRING(self->buf) + self->pos; maxlen = self->string_size - self->pos; if (len < 0 || len > maxlen) len = maxlen; if (len) { + start = PyBytes_AS_STRING(self->buf) + self->pos; n = memchr(start, '\n', len); if (n) /* Get the length from the current position to the end of |