summaryrefslogtreecommitdiffstats
path: root/Modules/_io
diff options
context:
space:
mode:
authorSerhiy Storchaka <storchaka@gmail.com>2015-09-03 22:08:54 (GMT)
committerSerhiy Storchaka <storchaka@gmail.com>2015-09-03 22:08:54 (GMT)
commitfb397790d25c42332e4cfacc01ccb8ab20e3e664 (patch)
tree96ed36f3774ded1f73f08e24f93025c40dc00391 /Modules/_io
parentfed0931de42ae75e06834441f9015a7439820118 (diff)
parent594e54c765c5d53b14547f30ee59018514d44698 (diff)
downloadcpython-fb397790d25c42332e4cfacc01ccb8ab20e3e664.zip
cpython-fb397790d25c42332e4cfacc01ccb8ab20e3e664.tar.gz
cpython-fb397790d25c42332e4cfacc01ccb8ab20e3e664.tar.bz2
Issue #24989: Fixed buffer overread in BytesIO.readline() if a position is
set beyond size. Based on patch by John Leitch.
Diffstat (limited to 'Modules/_io')
-rw-r--r--Modules/_io/bytesio.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/Modules/_io/bytesio.c b/Modules/_io/bytesio.c
index d46430d..31cc1f7 100644
--- a/Modules/_io/bytesio.c
+++ b/Modules/_io/bytesio.c
@@ -57,14 +57,18 @@ scan_eol(bytesio *self, Py_ssize_t len)
Py_ssize_t maxlen;
assert(self->buf != NULL);
+ assert(self->pos >= 0);
+
+ if (self->pos >= self->string_size)
+ return 0;
/* Move to the end of the line, up to the end of the string, s. */
- start = PyBytes_AS_STRING(self->buf) + self->pos;
maxlen = self->string_size - self->pos;
if (len < 0 || len > maxlen)
len = maxlen;
if (len) {
+ start = PyBytes_AS_STRING(self->buf) + self->pos;
n = memchr(start, '\n', len);
if (n)
/* Get the length from the current position to the end of