diff options
| author | R David Murray <rdmurray@bitdance.com> | 2014-10-12 18:26:30 (GMT) |
|---|---|---|
| committer | R David Murray <rdmurray@bitdance.com> | 2014-10-12 18:26:30 (GMT) |
| commit | 55bf20ad6e0bd9ca4c1b1a6dd7339972b4aa915e (patch) | |
| tree | 1d1c00fcabce20b7c876966f90e3727cedb87071 /Modules | |
| parent | e73b8c64b8cc2531b21135e0d0f07de11dc76ab3 (diff) | |
| download | cpython-55bf20ad6e0bd9ca4c1b1a6dd7339972b4aa915e.zip cpython-55bf20ad6e0bd9ca4c1b1a6dd7339972b4aa915e.tar.gz cpython-55bf20ad6e0bd9ca4c1b1a6dd7339972b4aa915e.tar.bz2 | |
#13096: Fix segfault in CTypes POINTER handling of large values.
Patch by Meador Inge.
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/_ctypes/callproc.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c index 6642dc3..19f59e0 100644 --- a/Modules/_ctypes/callproc.c +++ b/Modules/_ctypes/callproc.c @@ -1807,7 +1807,9 @@ POINTER(PyObject *self, PyObject *cls) return result; } if (PyString_CheckExact(cls)) { - buf = alloca(strlen(PyString_AS_STRING(cls)) + 3 + 1); + buf = PyMem_Malloc(strlen(PyString_AS_STRING(cls)) + 3 + 1); + if (buf == NULL) + return PyErr_NoMemory(); sprintf(buf, "LP_%s", PyString_AS_STRING(cls)); result = PyObject_CallFunction((PyObject *)Py_TYPE(&PyCPointer_Type), "s(O){}", @@ -1818,13 +1820,16 @@ POINTER(PyObject *self, PyObject *cls) key = PyLong_FromVoidPtr(result); } else if (PyType_Check(cls)) { typ = (PyTypeObject *)cls; - buf = alloca(strlen(typ->tp_name) + 3 + 1); + buf = PyMem_Malloc(strlen(typ->tp_name) + 3 + 1); + if (buf == NULL) + return PyErr_NoMemory(); sprintf(buf, "LP_%s", typ->tp_name); result = PyObject_CallFunction((PyObject *)Py_TYPE(&PyCPointer_Type), "s(O){sO}", buf, &PyCPointer_Type, "_type_", cls); + PyMem_Free(buf); if (result == NULL) return result; Py_INCREF(cls); |