diff options
| author | Stefan Krah <skrah@bytereef.org> | 2012-08-21 06:16:09 (GMT) |
|---|---|---|
| committer | Stefan Krah <skrah@bytereef.org> | 2012-08-21 06:16:09 (GMT) |
| commit | 7cacd2eb92dad7e63a0249974617de33f4c4a0e0 (patch) | |
| tree | 2f9e15fa1ce4862ec43197a211b56f222272f432 /Objects | |
| parent | 514dbb03ba23cd901381a9182871bbe2ebc14100 (diff) | |
| download | cpython-7cacd2eb92dad7e63a0249974617de33f4c4a0e0.zip cpython-7cacd2eb92dad7e63a0249974617de33f4c4a0e0.tar.gz cpython-7cacd2eb92dad7e63a0249974617de33f4c4a0e0.tar.bz2 | |
Issue #15736: Fix overflow in _PySequence_BytesToCharpArray().
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/abstract.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/Objects/abstract.c b/Objects/abstract.c index 299daf5..7705d05 100644 --- a/Objects/abstract.c +++ b/Objects/abstract.c @@ -2728,6 +2728,13 @@ _PySequence_BytesToCharpArray(PyObject* self) if (argc == -1) return NULL; + assert(argc >= 0); + + if ((size_t)argc > (PY_SSIZE_T_MAX-sizeof(char *)) / sizeof(char *)) { + PyErr_NoMemory(); + return NULL; + } + array = malloc((argc + 1) * sizeof(char *)); if (array == NULL) { PyErr_NoMemory(); |