diff options
| author | Thomas Wouters <thomas@python.org> | 2008-03-14 17:16:59 (GMT) |
|---|---|---|
| committer | Thomas Wouters <thomas@python.org> | 2008-03-14 17:16:59 (GMT) |
| commit | deef67481c37965474b64c7e703982998c20a654 (patch) | |
| tree | 93b07813979e474cb4eec489c599d1ddb6495584 /Python | |
| parent | 4a983c550e546a0cd3bb9349d301ac7cd0017c50 (diff) | |
| download | cpython-deef67481c37965474b64c7e703982998c20a654.zip cpython-deef67481c37965474b64c7e703982998c20a654.tar.gz cpython-deef67481c37965474b64c7e703982998c20a654.tar.bz2 | |
Fix crasher in unpacking assignments with star, where the size constraints
weren't checked.
Diffstat (limited to 'Python')
| -rw-r--r-- | Python/compile.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/Python/compile.c b/Python/compile.c index af6e067..f415519 100644 --- a/Python/compile.c +++ b/Python/compile.c @@ -2614,6 +2614,11 @@ compiler_list(struct compiler *c, expr_ty e) for (i = 0; i < n; i++) { expr_ty elt = asdl_seq_GET(e->v.List.elts, i); if (elt->kind == Starred_kind && !seen_star) { + if ((i >= (1 << 8)) || + (n-i-1 >= (INT_MAX >> 8))) + return compiler_error(c, + "too many expressions in " + "star-unpacking assignment"); ADDOP_I(c, UNPACK_EX, (i + ((n-i-1) << 8))); seen_star = 1; asdl_seq_SET(e->v.List.elts, i, elt->v.Starred.value); @@ -2642,6 +2647,11 @@ compiler_tuple(struct compiler *c, expr_ty e) for (i = 0; i < n; i++) { expr_ty elt = asdl_seq_GET(e->v.Tuple.elts, i); if (elt->kind == Starred_kind && !seen_star) { + if ((i >= (1 << 8)) || + (n-i-1 >= (INT_MAX >> 8))) + return compiler_error(c, + "too many expressions in " + "star-unpacking assignment"); ADDOP_I(c, UNPACK_EX, (i + ((n-i-1) << 8))); seen_star = 1; asdl_seq_SET(e->v.Tuple.elts, i, elt->v.Starred.value); |