diff options
| author | Bob Ippolito <bob@redivi.com> | 2008-07-19 21:59:50 (GMT) |
|---|---|---|
| committer | Bob Ippolito <bob@redivi.com> | 2008-07-19 21:59:50 (GMT) |
| commit | d648f64a530a77db93df89cc03306ef80b27ff4f (patch) | |
| tree | 629338683b67bb45d5452fb8a59b03cb0441e0dd /Modules/_json.c | |
| parent | 0147a761b1751a833bb11e176833be7082322b86 (diff) | |
| download | cpython-d648f64a530a77db93df89cc03306ef80b27ff4f.zip cpython-d648f64a530a77db93df89cc03306ef80b27ff4f.tar.gz cpython-d648f64a530a77db93df89cc03306ef80b27ff4f.tar.bz2 | |
#3322: bounds checking for _json.scanstring
Diffstat (limited to 'Modules/_json.c')
| -rw-r--r-- | Modules/_json.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/Modules/_json.c b/Modules/_json.c index ea6d66f..88510a7 100644 --- a/Modules/_json.c +++ b/Modules/_json.c @@ -235,6 +235,10 @@ scanstring_str(PyObject *pystr, Py_ssize_t end, char *encoding, int strict) if (chunks == NULL) { goto bail; } + if (end < 0 || len <= end) { + PyErr_SetString(PyExc_ValueError, "end is out of bounds"); + goto bail; + } while (1) { /* Find the end of the string or the next escape */ Py_UNICODE c = 0; @@ -245,7 +249,7 @@ scanstring_str(PyObject *pystr, Py_ssize_t end, char *encoding, int strict) break; } else if (strict && c <= 0x1f) { - raise_errmsg("Invalid control character at", pystr, begin); + raise_errmsg("Invalid control character at", pystr, next); goto bail; } } @@ -396,6 +400,10 @@ scanstring_unicode(PyObject *pystr, Py_ssize_t end, int strict) if (chunks == NULL) { goto bail; } + if (end < 0 || len <= end) { + PyErr_SetString(PyExc_ValueError, "end is out of bounds"); + goto bail; + } while (1) { /* Find the end of the string or the next escape */ Py_UNICODE c = 0; @@ -406,7 +414,7 @@ scanstring_unicode(PyObject *pystr, Py_ssize_t end, int strict) break; } else if (strict && c <= 0x1f) { - raise_errmsg("Invalid control character at", pystr, begin); + raise_errmsg("Invalid control character at", pystr, next); goto bail; } } |