diff options
| author | Martin Panter <vadmium+py@gmail.com> | 2016-07-18 07:53:13 (GMT) |
|---|---|---|
| committer | Martin Panter <vadmium+py@gmail.com> | 2016-07-18 07:53:13 (GMT) |
| commit | 371731ebfdc3ee754af8cda72dc7ee5442c7491b (patch) | |
| tree | 641dbeb4e984a2acd8e121986251c740303f1aba /Objects | |
| parent | 5852fa3f7202899d62a1f1d75d922f718784df7a (diff) | |
| download | cpython-371731ebfdc3ee754af8cda72dc7ee5442c7491b.zip cpython-371731ebfdc3ee754af8cda72dc7ee5442c7491b.tar.gz cpython-371731ebfdc3ee754af8cda72dc7ee5442c7491b.tar.bz2 | |
Issue #27507: Check for integer overflow in bytearray.extend()
Patch by Xiang Zhang.
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/bytearrayobject.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c index b21acfb..1458635 100644 --- a/Objects/bytearrayobject.c +++ b/Objects/bytearrayobject.c @@ -2474,7 +2474,17 @@ bytearray_extend(PyByteArrayObject *self, PyObject *iterable_of_ints) Py_DECREF(item); if (len >= buf_size) { - buf_size = len + (len >> 1) + 1; + Py_ssize_t addition; + if (len == PY_SSIZE_T_MAX) { + Py_DECREF(it); + Py_DECREF(bytearray_obj); + return PyErr_NoMemory(); + } + addition = len >> 1; + if (addition > PY_SSIZE_T_MAX - len - 1) + buf_size = PY_SSIZE_T_MAX; + else + buf_size = len + addition + 1; if (PyByteArray_Resize((PyObject *)bytearray_obj, buf_size) < 0) { Py_DECREF(it); Py_DECREF(bytearray_obj); |