diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2011-08-29 22:27:10 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2011-08-29 22:27:10 (GMT) |
| commit | 55549ec476c178ca4723ba97d4f00a015f427427 (patch) | |
| tree | 43dee50c756d4a81c23efcc254a703d6425d1fb2 /Modules/_pickle.c | |
| parent | 82be19f889e97618d73f405ad53ceffbee462008 (diff) | |
| download | cpython-55549ec476c178ca4723ba97d4f00a015f427427.zip cpython-55549ec476c178ca4723ba97d4f00a015f427427.tar.gz cpython-55549ec476c178ca4723ba97d4f00a015f427427.tar.bz2 | |
Issue #12847: Fix a crash with negative PUT and LONG_BINPUT arguments in
the C pickle implementation.
Diffstat (limited to 'Modules/_pickle.c')
| -rw-r--r-- | Modules/_pickle.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/Modules/_pickle.c b/Modules/_pickle.c index d7d81cd..20ee302 100644 --- a/Modules/_pickle.c +++ b/Modules/_pickle.c @@ -4853,8 +4853,12 @@ load_put(UnpicklerObject *self) return -1; idx = PyLong_AsSsize_t(key); Py_DECREF(key); - if (idx == -1 && PyErr_Occurred()) + if (idx < 0) { + if (!PyErr_Occurred()) + PyErr_SetString(PyExc_ValueError, + "negative PUT argument"); return -1; + } return _Unpickler_MemoPut(self, idx, value); } @@ -4893,6 +4897,11 @@ load_long_binput(UnpicklerObject *self) value = self->stack->data[Py_SIZE(self->stack) - 1]; idx = calc_binsize(s, 4); + if (idx < 0) { + PyErr_SetString(PyExc_ValueError, + "negative LONG_BINPUT argument"); + return -1; + } return _Unpickler_MemoPut(self, idx, value); } |