diff options
| author | Benjamin Peterson <benjamin@python.org> | 2014-09-29 23:01:18 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2014-09-29 23:01:18 (GMT) |
| commit | f8c4b3a730461c10766f66784c268ce0d923ad39 (patch) | |
| tree | 2286e3d9082e6c26f440409f1142a38bc0333dd1 /Objects/stringobject.c | |
| parent | b2c432845c3f0e112487596c5538a0f099f51c7c (diff) | |
| download | cpython-f8c4b3a730461c10766f66784c268ce0d923ad39.zip cpython-f8c4b3a730461c10766f66784c268ce0d923ad39.tar.gz cpython-f8c4b3a730461c10766f66784c268ce0d923ad39.tar.bz2 | |
fix overflow checking in PyString_Repr (closes #22519)
Diffstat (limited to 'Objects/stringobject.c')
| -rw-r--r-- | Objects/stringobject.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/Objects/stringobject.c b/Objects/stringobject.c index f95857a..46f46db 100644 --- a/Objects/stringobject.c +++ b/Objects/stringobject.c @@ -926,13 +926,14 @@ PyObject * PyString_Repr(PyObject *obj, int smartquotes) { register PyStringObject* op = (PyStringObject*) obj; - size_t newsize = 2 + 4 * Py_SIZE(op); + size_t newsize; PyObject *v; - if (newsize > PY_SSIZE_T_MAX || newsize / 4 != Py_SIZE(op)) { + if (Py_SIZE(op) > (PY_SSIZE_T_MAX - 2)/4) { PyErr_SetString(PyExc_OverflowError, "string is too large to make repr"); return NULL; } + newsize = 2 + 4*Py_SIZE(op); v = PyString_FromStringAndSize((char *)NULL, newsize); if (v == NULL) { return NULL; |