diff options
| author | Neal Norwitz <nnorwitz@gmail.com> | 2008-08-24 07:08:55 (GMT) |
|---|---|---|
| committer | Neal Norwitz <nnorwitz@gmail.com> | 2008-08-24 07:08:55 (GMT) |
| commit | 3ce5d9207e66d61d4b0502cf47ed2d2bcdd2212f (patch) | |
| tree | c29add3a6b61f321009d73a91464f45b5d10862a /Modules | |
| parent | 06db799a53cba0396908d291bbe4bcc6c1c50daa (diff) | |
| download | cpython-3ce5d9207e66d61d4b0502cf47ed2d2bcdd2212f.zip cpython-3ce5d9207e66d61d4b0502cf47ed2d2bcdd2212f.tar.gz cpython-3ce5d9207e66d61d4b0502cf47ed2d2bcdd2212f.tar.bz2 | |
Closes release blocker #3627.
Merged revisions 65335 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/trunk
TESTED=./python -E -tt ./Lib/test/regrtest.py -uall (both debug and opt)
........
r65335 | neal.norwitz | 2008-07-31 10:17:14 -0700 (Thu, 31 Jul 2008) | 1 line
Security patches from Apple: prevent int overflow when allocating memory
........
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/gcmodule.c | 7 | ||||
| -rw-r--r-- | Modules/mmapmodule.c | 2 |
2 files changed, 7 insertions, 2 deletions
diff --git a/Modules/gcmodule.c b/Modules/gcmodule.c index 51bcd79f..f7eef4d 100644 --- a/Modules/gcmodule.c +++ b/Modules/gcmodule.c @@ -1318,7 +1318,10 @@ PyObject * _PyObject_GC_Malloc(size_t basicsize) { PyObject *op; - PyGC_Head *g = (PyGC_Head *)PyObject_MALLOC( + PyGC_Head *g; + if (basicsize > PY_SSIZE_T_MAX - sizeof(PyGC_Head)) + return PyErr_NoMemory(); + g = (PyGC_Head *)PyObject_MALLOC( sizeof(PyGC_Head) + basicsize); if (g == NULL) return PyErr_NoMemory(); @@ -1361,6 +1364,8 @@ _PyObject_GC_Resize(PyVarObject *op, Py_ssize_t nitems) { const size_t basicsize = _PyObject_VAR_SIZE(Py_TYPE(op), nitems); PyGC_Head *g = AS_GC(op); + if (basicsize > PY_SSIZE_T_MAX - sizeof(PyGC_Head)) + return (PyVarObject *)PyErr_NoMemory(); g = (PyGC_Head *)PyObject_REALLOC(g, sizeof(PyGC_Head) + basicsize); if (g == NULL) return (PyVarObject *)PyErr_NoMemory(); diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c index 8abf0ff..9adef9b 100644 --- a/Modules/mmapmodule.c +++ b/Modules/mmapmodule.c @@ -245,7 +245,7 @@ mmap_read_method(mmap_object *self, return(NULL); /* silently 'adjust' out-of-range requests */ - if ((self->pos + num_bytes) > self->size) { + if (num_bytes > self->size - self->pos) { num_bytes -= (self->pos+num_bytes) - self->size; } result = PyByteArray_FromStringAndSize(self->data+self->pos, num_bytes); |