diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2014-11-02 17:41:56 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2014-11-02 17:41:56 (GMT) |
| commit | 8a03896cace7cf2b8634c1409722fe6d3f9c8bcd (patch) | |
| tree | 23f5e2d94a09abf5a2c80d095c26bd7f5e391dac /Objects/obmalloc.c | |
| parent | c58e3a449bfcf42b4d3ec0495960472adaaa952e (diff) | |
| parent | cc23154d020723dc85d055324861f6a8f54fe0f7 (diff) | |
| download | cpython-8a03896cace7cf2b8634c1409722fe6d3f9c8bcd.zip cpython-8a03896cace7cf2b8634c1409722fe6d3f9c8bcd.tar.gz cpython-8a03896cace7cf2b8634c1409722fe6d3f9c8bcd.tar.bz2 | |
Issue #22335: Fix crash when trying to enlarge a bytearray to 0x7fffffff bytes on a 32-bit platform.
Diffstat (limited to 'Objects/obmalloc.c')
| -rw-r--r-- | Objects/obmalloc.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/Objects/obmalloc.c b/Objects/obmalloc.c index 2036e37..e900cc3 100644 --- a/Objects/obmalloc.c +++ b/Objects/obmalloc.c @@ -1828,8 +1828,8 @@ _PyMem_DebugAlloc(int use_calloc, void *ctx, size_t nbytes) bumpserialno(); total = nbytes + 4*SST; - if (total < nbytes) - /* overflow: can't represent total as a size_t */ + if (nbytes > PY_SSIZE_T_MAX - 4*SST) + /* overflow: can't represent total as a Py_ssize_t */ return NULL; if (use_calloc) @@ -1909,8 +1909,8 @@ _PyMem_DebugRealloc(void *ctx, void *p, size_t nbytes) bumpserialno(); original_nbytes = read_size_t(q - 2*SST); total = nbytes + 4*SST; - if (total < nbytes) - /* overflow: can't represent total as a size_t */ + if (nbytes > PY_SSIZE_T_MAX - 4*SST) + /* overflow: can't represent total as a Py_ssize_t */ return NULL; /* Resize and add decorations. We may get a new pointer here, in which |