diff options
| author | Yury Selivanov <yury@magic.io> | 2017-07-05 17:32:03 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-07-05 17:32:03 (GMT) |
| commit | 833a3b0d3707200daeaccdd218e8f18a190284aa (patch) | |
| tree | 88cc8ea50a8f2709b437b7308015ba2a48538788 /Modules | |
| parent | 8207c17486baece8ed0ac42d9f8d69ecec4ba7e4 (diff) | |
| download | cpython-833a3b0d3707200daeaccdd218e8f18a190284aa.zip cpython-833a3b0d3707200daeaccdd218e8f18a190284aa.tar.gz cpython-833a3b0d3707200daeaccdd218e8f18a190284aa.tar.bz2 | |
bpo-30828: Fix out of bounds write in `asyncio.CFuture.remove_done_callback() (#2569)
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/_asynciomodule.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/Modules/_asynciomodule.c b/Modules/_asynciomodule.c index b8a88e6..b998a04 100644 --- a/Modules/_asynciomodule.c +++ b/Modules/_asynciomodule.c @@ -532,9 +532,16 @@ _asyncio_Future_remove_done_callback(FutureObj *self, PyObject *fn) goto fail; } if (ret == 0) { - Py_INCREF(item); - PyList_SET_ITEM(newlist, j, item); - j++; + if (j < len) { + Py_INCREF(item); + PyList_SET_ITEM(newlist, j, item); + j++; + } + else { + if (PyList_Append(newlist, item)) { + goto fail; + } + } } } |