diff options
| author | Serhiy Storchaka <storchaka@gmail.com> | 2015-07-26 05:49:37 (GMT) |
|---|---|---|
| committer | Serhiy Storchaka <storchaka@gmail.com> | 2015-07-26 05:49:37 (GMT) |
| commit | cf74c1996e084aa840db0782da833f640a3923e3 (patch) | |
| tree | c6c1f2619f71dceb38bab0f5671cdec207062d63 /Modules | |
| parent | 7f18ac4a5962365a948d118176075e2ca045fdc7 (diff) | |
| download | cpython-cf74c1996e084aa840db0782da833f640a3923e3.zip cpython-cf74c1996e084aa840db0782da833f640a3923e3.tar.gz cpython-cf74c1996e084aa840db0782da833f640a3923e3.tar.bz2 | |
Issue #24613: Calling array.fromstring() with self is no longer allowed
to prevent the use-after-free error. Patch by John Leitch.
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/arraymodule.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c index 3ed8a33..1d1f0d3 100644 --- a/Modules/arraymodule.c +++ b/Modules/arraymodule.c @@ -1380,6 +1380,11 @@ array_fromstring(arrayobject *self, PyObject *args) int itemsize = self->ob_descr->itemsize; if (!PyArg_ParseTuple(args, "s#:fromstring", &str, &n)) return NULL; + if (str == self->ob_item) { + PyErr_SetString(PyExc_ValueError, + "array.fromstring(x): x cannot be self"); + return NULL; + } if (n % itemsize != 0) { PyErr_SetString(PyExc_ValueError, "string length not a multiple of item size"); |