diff options
| -rw-r--r-- | Lib/test/test_capi.py | 8 | ||||
| -rw-r--r-- | Objects/abstract.c | 7 |
2 files changed, 15 insertions, 0 deletions
diff --git a/Lib/test/test_capi.py b/Lib/test/test_capi.py index 612e639..4d931f8 100644 --- a/Lib/test/test_capi.py +++ b/Lib/test/test_capi.py @@ -67,6 +67,14 @@ class CAPITest(unittest.TestCase): return 1 self.assertRaises(TypeError, _posixsubprocess.fork_exec, 1,Z(),3,[1, 2],5,6,7,8,9,10,11,12,13,14,15,16,17) + # Issue #15736: overflow in _PySequence_BytesToCharpArray() + class Z(object): + def __len__(self): + return sys.maxsize + def __getitem__(self, i): + return b'x' + self.assertRaises(MemoryError, _posixsubprocess.fork_exec, + 1,Z(),3,[1, 2],5,6,7,8,9,10,11,12,13,14,15,16,17) @unittest.skipUnless(_posixsubprocess, '_posixsubprocess required for this test.') def test_subprocess_fork_exec(self): diff --git a/Objects/abstract.c b/Objects/abstract.c index 299daf5..7705d05 100644 --- a/Objects/abstract.c +++ b/Objects/abstract.c @@ -2728,6 +2728,13 @@ _PySequence_BytesToCharpArray(PyObject* self) if (argc == -1) return NULL; + assert(argc >= 0); + + if ((size_t)argc > (PY_SSIZE_T_MAX-sizeof(char *)) / sizeof(char *)) { + PyErr_NoMemory(); + return NULL; + } + array = malloc((argc + 1) * sizeof(char *)); if (array == NULL) { PyErr_NoMemory(); |