diff options
| author | Benjamin Peterson <benjamin@python.org> | 2015-07-25 06:25:35 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2015-07-25 06:25:35 (GMT) |
| commit | 455a2a30a3743faa1819245d28a9fb46bd7c41a8 (patch) | |
| tree | 88c47e1365f5df24f470ea8bd0ff217f43cab454 /Modules/stropmodule.c | |
| parent | 80277ed1946ddfd144ac35ca7bca3cc85e876c70 (diff) | |
| download | cpython-455a2a30a3743faa1819245d28a9fb46bd7c41a8.zip cpython-455a2a30a3743faa1819245d28a9fb46bd7c41a8.tar.gz cpython-455a2a30a3743faa1819245d28a9fb46bd7c41a8.tar.bz2 | |
proper overflow checks for mymemreplace (closes #24708)
Diffstat (limited to 'Modules/stropmodule.c')
| -rw-r--r-- | Modules/stropmodule.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/Modules/stropmodule.c b/Modules/stropmodule.c index 913bef8..10d3013 100644 --- a/Modules/stropmodule.c +++ b/Modules/stropmodule.c @@ -1094,7 +1094,7 @@ mymemreplace(const char *str, Py_ssize_t len, /* input string */ { char *out_s; char *new_s; - Py_ssize_t nfound, offset, new_len; + Py_ssize_t nfound, offset, new_len, delta_len, abs_delta; if (len == 0 || pat_len > len) goto return_same; @@ -1108,7 +1108,14 @@ mymemreplace(const char *str, Py_ssize_t len, /* input string */ if (nfound == 0) goto return_same; - new_len = len + nfound*(sub_len - pat_len); + delta_len = sub_len - pat_len; + abs_delta = (delta_len < 0) ? -delta_len : delta_len; + if (PY_SSIZE_T_MAX/nfound < abs_delta) + return NULL; + delta_len *= nfound; + if (PY_SSIZE_T_MAX - len < delta_len) + return NULL; + new_len = len + delta_len; if (new_len == 0) { /* Have to allocate something for the caller to free(). */ out_s = (char *)PyMem_MALLOC(1); |