summaryrefslogtreecommitdiffstats
path: root/Python
diff options
context:
space:
mode:
authorThomas Wouters <thomas@python.org>2008-03-14 17:16:59 (GMT)
committerThomas Wouters <thomas@python.org>2008-03-14 17:16:59 (GMT)
commitdeef67481c37965474b64c7e703982998c20a654 (patch)
tree93b07813979e474cb4eec489c599d1ddb6495584 /Python
parent4a983c550e546a0cd3bb9349d301ac7cd0017c50 (diff)
downloadcpython-deef67481c37965474b64c7e703982998c20a654.zip
cpython-deef67481c37965474b64c7e703982998c20a654.tar.gz
cpython-deef67481c37965474b64c7e703982998c20a654.tar.bz2
Fix crasher in unpacking assignments with star, where the size constraints
weren't checked.
Diffstat (limited to 'Python')
-rw-r--r--Python/compile.c10
1 files changed, 10 insertions, 0 deletions
diff --git a/Python/compile.c b/Python/compile.c
index af6e067..f415519 100644
--- a/Python/compile.c
+++ b/Python/compile.c
@@ -2614,6 +2614,11 @@ compiler_list(struct compiler *c, expr_ty e)
for (i = 0; i < n; i++) {
expr_ty elt = asdl_seq_GET(e->v.List.elts, i);
if (elt->kind == Starred_kind && !seen_star) {
+ if ((i >= (1 << 8)) ||
+ (n-i-1 >= (INT_MAX >> 8)))
+ return compiler_error(c,
+ "too many expressions in "
+ "star-unpacking assignment");
ADDOP_I(c, UNPACK_EX, (i + ((n-i-1) << 8)));
seen_star = 1;
asdl_seq_SET(e->v.List.elts, i, elt->v.Starred.value);
@@ -2642,6 +2647,11 @@ compiler_tuple(struct compiler *c, expr_ty e)
for (i = 0; i < n; i++) {
expr_ty elt = asdl_seq_GET(e->v.Tuple.elts, i);
if (elt->kind == Starred_kind && !seen_star) {
+ if ((i >= (1 << 8)) ||
+ (n-i-1 >= (INT_MAX >> 8)))
+ return compiler_error(c,
+ "too many expressions in "
+ "star-unpacking assignment");
ADDOP_I(c, UNPACK_EX, (i + ((n-i-1) << 8)));
seen_star = 1;
asdl_seq_SET(e->v.Tuple.elts, i, elt->v.Starred.value);