diff options
| author | Serhiy Storchaka <storchaka@gmail.com> | 2013-05-28 13:24:45 (GMT) |
|---|---|---|
| committer | Serhiy Storchaka <storchaka@gmail.com> | 2013-05-28 13:24:45 (GMT) |
| commit | 37a79a12d1a9c337e0a8f7a12f11600c44be824f (patch) | |
| tree | 5934412b8dd1754b4f959c3011284114e1bfe686 /Modules/_io | |
| parent | 12516e2c1b6dc577ea57ba45780637092afec671 (diff) | |
| download | cpython-37a79a12d1a9c337e0a8f7a12f11600c44be824f.zip cpython-37a79a12d1a9c337e0a8f7a12f11600c44be824f.tar.gz cpython-37a79a12d1a9c337e0a8f7a12f11600c44be824f.tar.bz2 | |
Issue #18025: Fixed a segfault in io.BufferedIOBase.readinto() when raw
stream's read() returns more bytes than requested.
Diffstat (limited to 'Modules/_io')
| -rw-r--r-- | Modules/_io/bufferedio.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/Modules/_io/bufferedio.c b/Modules/_io/bufferedio.c index 2b39f66..7f180a4 100644 --- a/Modules/_io/bufferedio.c +++ b/Modules/_io/bufferedio.c @@ -69,6 +69,14 @@ bufferediobase_readinto(PyObject *self, PyObject *args) } len = Py_SIZE(data); + if (len > buf.len) { + PyErr_Format(PyExc_ValueError, + "read() returned too much data: " + "%zd bytes requested, %zd returned", + buf.len, len); + Py_DECREF(data); + goto error; + } memcpy(buf.buf, PyBytes_AS_STRING(data), len); PyBuffer_Release(&buf); |