diff options
| author | Christian Heimes <christian@cheimes.de> | 2012-09-12 13:31:43 (GMT) |
|---|---|---|
| committer | Christian Heimes <christian@cheimes.de> | 2012-09-12 13:31:43 (GMT) |
| commit | 79b97ee2ab2620921d409ed4010e84f6c227b470 (patch) | |
| tree | 7713ef1b17697ca8f6c2170170a71ed80fea6394 /Objects/longobject.c | |
| parent | 4b2f9e914d497d6b2b5ec09a03da8b6f171dffed (diff) | |
| download | cpython-79b97ee2ab2620921d409ed4010e84f6c227b470.zip cpython-79b97ee2ab2620921d409ed4010e84f6c227b470.tar.gz cpython-79b97ee2ab2620921d409ed4010e84f6c227b470.tar.bz2 | |
Fix out of bounds read in long_new() for empty bytes with an explicit base. int(b'', somebase) calls PyLong_FromString() with char* of length 1 but the function accesses the first argument at offset 1. CID 715359
Diffstat (limited to 'Objects/longobject.c')
| -rw-r--r-- | Objects/longobject.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/Objects/longobject.c b/Objects/longobject.c index a735e33..f2f63af 100644 --- a/Objects/longobject.c +++ b/Objects/longobject.c @@ -4149,8 +4149,8 @@ long_new(PyTypeObject *type, PyObject *args, PyObject *kwds) string = PyByteArray_AS_STRING(x); else string = PyBytes_AS_STRING(x); - if (strlen(string) != (size_t)size) { - /* We only see this if there's a null byte in x, + if (strlen(string) != (size_t)size || !size) { + /* We only see this if there's a null byte in x or x is empty, x is a bytes or buffer, *and* a base is given. */ PyErr_Format(PyExc_ValueError, "invalid literal for int() with base %d: %R", |