Issue #8650: zlib.compress() and zlib.decompress() raise an OverflowError if

the input buffer length doesn't fit into an unsigned int (length bigger than
2^32-1 bytes).

1 files changed, 18 insertions, 4 deletions

diff --git a/Modules/zlibmodule.c b/Modules/zlibmodule.c
index 54ab9a1..a03045e 100644
--- a/Modules/zlibmodule.c
+++ b/Modules/zlibmodule.c
@@ -117,14 +117,21 @@ PyZlib_compress(PyObject *self, PyObject *args)
     PyObject *ReturnVal = NULL;
     Py_buffer pinput;
     Byte *input, *output;
-    int length, level=Z_DEFAULT_COMPRESSION, err;
+    unsigned int length;
+    int level=Z_DEFAULT_COMPRESSION, err;
     z_stream zst;
 
     /* require Python string object, optional 'level' arg */
     if (!PyArg_ParseTuple(args, "y*|i:compress", &pinput, &level))
         return NULL;
-    input = pinput.buf;
+
+    if (pinput.len > UINT_MAX) {
+        PyErr_SetString(PyExc_OverflowError,
+            "size does not fit in an unsigned int");
+        return NULL;
+    }
     length = pinput.len;
+    input = pinput.buf;
 
     zst.avail_out = length + length/1000 + 12 + 1;
 
@@ -199,7 +206,8 @@ PyZlib_decompress(PyObject *self, PyObject *args)
     PyObject *result_str;
     Py_buffer pinput;
     Byte *input;
-    int length, err;
+    unsigned int length;
+    int err;
     int wsize=DEF_WBITS;
     Py_ssize_t r_strlen=DEFAULTALLOC;
     z_stream zst;
@@ -207,8 +215,14 @@ PyZlib_decompress(PyObject *self, PyObject *args)
     if (!PyArg_ParseTuple(args, "y*|in:decompress",
                           &pinput, &wsize, &r_strlen))
         return NULL;
-    input = pinput.buf;
+
+    if (pinput.len > UINT_MAX) {
+        PyErr_SetString(PyExc_OverflowError,
+            "size does not fit in an unsigned int");
+        return NULL;
+    }
     length = pinput.len;
+    input = pinput.buf;
 
     if (r_strlen <= 0)
         r_strlen = 1;