diff options
| author | Benjamin Peterson <benjamin@python.org> | 2016-08-14 00:17:06 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2016-08-14 00:17:06 (GMT) |
| commit | 6e01d90cc8bfac920bd4f7143b3968a8a21079d9 (patch) | |
| tree | 794a1e91babec2a3113205b15832ebaa19a73725 /Modules | |
| parent | 6f25003291610fd7696aa09b725742a499d6b2cf (diff) | |
| download | cpython-6e01d90cc8bfac920bd4f7143b3968a8a21079d9.zip cpython-6e01d90cc8bfac920bd4f7143b3968a8a21079d9.tar.gz cpython-6e01d90cc8bfac920bd4f7143b3968a8a21079d9.tar.bz2 | |
check for overflow in join_append_data (closes #27758)
Reported by Thomas E. Hybel
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/_csv.c | 23 |
1 files changed, 19 insertions, 4 deletions
diff --git a/Modules/_csv.c b/Modules/_csv.c index f5f6e71..dcb671e 100644 --- a/Modules/_csv.c +++ b/Modules/_csv.c @@ -1002,11 +1002,19 @@ join_append_data(WriterObj *self, unsigned int field_kind, void *field_data, int i; Py_ssize_t rec_len; -#define ADDCH(c) \ +#define INCLEN \ + do {\ + if (!copy_phase && rec_len == PY_SSIZE_T_MAX) { \ + goto overflow; \ + } \ + rec_len++; \ + } while(0) + +#define ADDCH(c) \ do {\ if (copy_phase) \ self->rec[rec_len] = c;\ - rec_len++;\ + INCLEN;\ } while(0) rec_len = self->rec_len; @@ -1072,11 +1080,18 @@ join_append_data(WriterObj *self, unsigned int field_kind, void *field_data, if (*quoted) { if (copy_phase) ADDCH(dialect->quotechar); - else - rec_len += 2; + else { + INCLEN; /* starting quote */ + INCLEN; /* ending quote */ + } } return rec_len; + + overflow: + PyErr_NoMemory(); + return -1; #undef ADDCH +#undef INCLEN } static int |