diff options
| author | Benjamin Peterson <benjamin@python.org> | 2014-04-14 02:10:38 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2014-04-14 02:10:38 (GMT) |
| commit | 99b5afab74428e5ddfd877bdf3aa8a8c479696b1 (patch) | |
| tree | 44293ac5d0a038577e6d671f2488126ef3cab7eb /Modules | |
| parent | 80e6af1f61f2d63ff45ada00be841db9ad5e6c9f (diff) | |
| download | cpython-99b5afab74428e5ddfd877bdf3aa8a8c479696b1.zip cpython-99b5afab74428e5ddfd877bdf3aa8a8c479696b1.tar.gz cpython-99b5afab74428e5ddfd877bdf3aa8a8c479696b1.tar.bz2 | |
in scan_once, prevent the reading of arbitrary memory when passed a negative index
Bug reported by Guido Vranken.
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/_json.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/Modules/_json.c b/Modules/_json.c index 01436b6..5bd52cb 100644 --- a/Modules/_json.c +++ b/Modules/_json.c @@ -930,7 +930,10 @@ scan_once_unicode(PyScannerObject *s, PyObject *pystr, Py_ssize_t idx, Py_ssize_ PyObject *res; Py_UNICODE *str = PyUnicode_AS_UNICODE(pystr); Py_ssize_t length = PyUnicode_GET_SIZE(pystr); - if (idx >= length) { + if (idx < 0) + /* Compatibility with Python version. */ + idx += length; + if (idx < 0 || idx >= length) { PyErr_SetNone(PyExc_StopIteration); return NULL; } |