diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2011-08-29 22:28:40 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2011-08-29 22:28:40 (GMT) |
| commit | a514eb95f30306a11a14f8a3b9cbf229c6af6137 (patch) | |
| tree | 9448e0e80659d32aa1c11e78c905e21a87ca320d /Modules/_pickle.c | |
| parent | ee763e2acc469fa2f423440517b9bc227fbbe79c (diff) | |
| parent | 55549ec476c178ca4723ba97d4f00a015f427427 (diff) | |
| download | cpython-a514eb95f30306a11a14f8a3b9cbf229c6af6137.zip cpython-a514eb95f30306a11a14f8a3b9cbf229c6af6137.tar.gz cpython-a514eb95f30306a11a14f8a3b9cbf229c6af6137.tar.bz2 | |
Issue #12847: Fix a crash with negative PUT and LONG_BINPUT arguments in
the C pickle implementation.
Diffstat (limited to 'Modules/_pickle.c')
| -rw-r--r-- | Modules/_pickle.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/Modules/_pickle.c b/Modules/_pickle.c index 541bd1b..0fbd440 100644 --- a/Modules/_pickle.c +++ b/Modules/_pickle.c @@ -4873,8 +4873,12 @@ load_put(UnpicklerObject *self) return -1; idx = PyLong_AsSsize_t(key); Py_DECREF(key); - if (idx == -1 && PyErr_Occurred()) + if (idx < 0) { + if (!PyErr_Occurred()) + PyErr_SetString(PyExc_ValueError, + "negative PUT argument"); return -1; + } return _Unpickler_MemoPut(self, idx, value); } @@ -4913,6 +4917,11 @@ load_long_binput(UnpicklerObject *self) value = self->stack->data[Py_SIZE(self->stack) - 1]; idx = calc_binsize(s, 4); + if (idx < 0) { + PyErr_SetString(PyExc_ValueError, + "negative LONG_BINPUT argument"); + return -1; + } return _Unpickler_MemoPut(self, idx, value); } |