diff options
| author | Benjamin Peterson <benjamin@python.org> | 2014-10-15 15:47:36 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2014-10-15 15:47:36 (GMT) |
| commit | e1bd38c03c16cd27227b3148d2be0ef1ab678448 (patch) | |
| tree | 6ca661c659881b0785ed35ed82bdb9e1d07c6831 /Objects/unicodeobject.c | |
| parent | 77a75b3db1b3c63833067f6864e62dcf312ded05 (diff) | |
| download | cpython-e1bd38c03c16cd27227b3148d2be0ef1ab678448.zip cpython-e1bd38c03c16cd27227b3148d2be0ef1ab678448.tar.gz cpython-e1bd38c03c16cd27227b3148d2be0ef1ab678448.tar.bz2 | |
fix integer overflow in unicode case operations (closes #22643)
Diffstat (limited to 'Objects/unicodeobject.c')
| -rw-r--r-- | Objects/unicodeobject.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 1ce5caa..35da457 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -9484,6 +9484,11 @@ case_operation(PyObject *self, kind = PyUnicode_KIND(self); data = PyUnicode_DATA(self); length = PyUnicode_GET_LENGTH(self); + if (length > PY_SSIZE_T_MAX / 3 || + length > PY_SIZE_MAX / (3 * sizeof(Py_UCS4))) { + PyErr_SetString(PyExc_OverflowError, "string is too long"); + return NULL; + } tmp = PyMem_MALLOC(sizeof(Py_UCS4) * 3 * length); if (tmp == NULL) return PyErr_NoMemory(); |