diff options
| author | Benjamin Peterson <benjamin@python.org> | 2014-10-15 15:49:15 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2014-10-15 15:49:15 (GMT) |
| commit | 69252643344ae4e80b4582ec6472401d59b3540b (patch) | |
| tree | 7ad08d29b09cfcacd87af561dddb845bbc86fac3 /Objects | |
| parent | 94522ebe388d694c9ec46b01c1ab4777bf6d8c9a (diff) | |
| parent | 1cbb3fe775c210459f53386b8172f5f2965ee33b (diff) | |
| download | cpython-69252643344ae4e80b4582ec6472401d59b3540b.zip cpython-69252643344ae4e80b4582ec6472401d59b3540b.tar.gz cpython-69252643344ae4e80b4582ec6472401d59b3540b.tar.bz2 | |
merge 3.4 (#22643)
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/unicodeobject.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 868485f..4a69e66 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -9675,6 +9675,11 @@ case_operation(PyObject *self, kind = PyUnicode_KIND(self); data = PyUnicode_DATA(self); length = PyUnicode_GET_LENGTH(self); + if (length > PY_SSIZE_T_MAX / 3 || + length > PY_SIZE_MAX / (3 * sizeof(Py_UCS4))) { + PyErr_SetString(PyExc_OverflowError, "string is too long"); + return NULL; + } tmp = PyMem_MALLOC(sizeof(Py_UCS4) * 3 * length); if (tmp == NULL) return PyErr_NoMemory(); |