diff options
| -rw-r--r-- | Misc/NEWS | 62 | ||||
| -rw-r--r-- | Objects/unicodeobject.c | 64 |
2 files changed, 109 insertions, 17 deletions
@@ -10,6 +10,8 @@ Release date: TBA Core and Builtins ----------------- +- Issue #22518: Fix integer overflow issues in latin-1 encoding. + - Issue #16324: _charset parameter of MIMEText now also accepts email.charset.Charset instances. Initial patch by Claude Paroz. @@ -27,6 +29,66 @@ Core and Builtins argument contains not permitted null character or byte. - Issue #22258: Fix the internal function set_inheritable() on Illumos. + +Library +------- + +- Issue #22448: Improve canceled timer handles cleanup to prevent + unbound memory usage. Patch by Joshua Moore-Oliva. + +Build +----- + +- Issue #16537: Check whether self.extensions is empty in setup.py. Patch by + Jonathan Hosmer. + + +What's New in Python 3.4.2? +=========================== + +Release date: 2014-10-06 + +Core and Builtins +----------------- + +Library +------- + +- Issue #10510: distutils register and upload methods now use HTML standards + compliant CRLF line endings. + +- Issue #9850: Fixed macpath.join() for empty first component. Patch by + Oleg Oshmyan. + +- Issue #22427: TemporaryDirectory no longer attempts to clean up twice when + used in the with statement in generator. + +- Issue #20912: Now directories added to ZIP file have correct Unix and MS-DOS + directory attributes. + +- Issue #21866: ZipFile.close() no longer writes ZIP64 central directory + records if allowZip64 is false. + +- Issue #22415: Fixed debugging output of the GROUPREF_EXISTS opcode in the re + module. Removed trailing spaces in debugging output. + +- Issue #22423: Unhandled exception in thread no longer causes unhandled + AttributeError when sys.stderr is None. + +- Issue #21332: Ensure that ``bufsize=1`` in subprocess.Popen() selects + line buffering, rather than block buffering. Patch by Akira Li. + + +What's New in Python 3.4.2rc1? +============================== + +Release date: 2014-09-22 + +Core and Builtins +----------------- + +- Issue #22258: Fix the the internal function set_inheritable() on Illumos. +>>>>>>> other This platform exposes the function ``ioctl(FIOCLEX)``, but calling it fails with errno is ENOTTY: "Inappropriate ioctl for device". set_inheritable() now falls back to the slower ``fcntl()`` (``F_GETFD`` and then ``F_SETFD``). diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 5a3ccaf..085798a 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -4093,16 +4093,21 @@ unicode_decode_call_errorhandler_wchar( have+the replacement+the rest of the string (starting at the new input position), so we won't have to check space when there are no errors in the rest of the string) */ - requiredsize = *outpos + repwlen + insize-newpos; + requiredsize = *outpos; + if (requiredsize > PY_SSIZE_T_MAX - repwlen) + goto overflow; + requiredsize += repwlen; + if (requiredsize > PY_SSIZE_T_MAX - (insize - newpos)) + goto overflow; + requiredsize += insize - newpos; if (requiredsize > outsize) { - if (requiredsize < 2*outsize) + if (outsize <= PY_SSIZE_T_MAX/2 && requiredsize < 2*outsize) requiredsize = 2*outsize; if (unicode_resize(output, requiredsize) < 0) goto onError; } wcsncpy(_PyUnicode_WSTR(*output) + *outpos, repwstr, repwlen); *outpos += repwlen; - *endinpos = newpos; *inptr = *input + newpos; @@ -4110,6 +4115,10 @@ unicode_decode_call_errorhandler_wchar( Py_XDECREF(restuple); return 0; + overflow: + PyErr_SetString(PyExc_OverflowError, + "decoded result is too long for a Python string"); + onError: Py_XDECREF(restuple); return -1; @@ -6502,7 +6511,7 @@ unicode_encode_ucs1(PyObject *unicode, Py_ssize_t collstart = pos; Py_ssize_t collend = pos; /* find all unecodable characters */ - while ((collend < size) && (PyUnicode_READ(kind, data, collend)>=limit)) + while ((collend < size) && (PyUnicode_READ(kind, data, collend) >= limit)) ++collend; /* cache callback name lookup (if not done yet, i.e. it's the first error) */ if (known_errorHandler==-1) { @@ -6522,36 +6531,43 @@ unicode_encode_ucs1(PyObject *unicode, raise_encode_exception(&exc, encoding, unicode, collstart, collend, reason); goto onError; case 2: /* replace */ - while (collstart++<collend) + while (collstart++ < collend) *str++ = '?'; /* fall through */ case 3: /* ignore */ pos = collend; break; case 4: /* xmlcharrefreplace */ respos = str - PyBytes_AS_STRING(res); + requiredsize = respos; /* determine replacement size */ - for (i = collstart, repsize = 0; i < collend; ++i) { + for (i = collstart; i < collend; ++i) { Py_UCS4 ch = PyUnicode_READ(kind, data, i); + Py_ssize_t incr; if (ch < 10) - repsize += 2+1+1; + incr = 2+1+1; else if (ch < 100) - repsize += 2+2+1; + incr = 2+2+1; else if (ch < 1000) - repsize += 2+3+1; + incr = 2+3+1; else if (ch < 10000) - repsize += 2+4+1; + incr = 2+4+1; else if (ch < 100000) - repsize += 2+5+1; + incr = 2+5+1; else if (ch < 1000000) - repsize += 2+6+1; + incr = 2+6+1; else { assert(ch <= MAX_UNICODE); - repsize += 2+7+1; + incr = 2+7+1; } + if (requiredsize > PY_SSIZE_T_MAX - incr) + goto overflow; + requiredsize += incr; } - requiredsize = respos+repsize+(size-collend); + if (requiredsize > PY_SSIZE_T_MAX - (size - collend)) + goto overflow; + requiredsize += size - collend; if (requiredsize > ressize) { - if (requiredsize<2*ressize) + if (ressize <= PY_SSIZE_T_MAX/2 && requiredsize < 2*ressize) requiredsize = 2*ressize; if (_PyBytes_Resize(&res, requiredsize)) goto onError; @@ -6577,6 +6593,10 @@ unicode_encode_ucs1(PyObject *unicode, if (repsize > 1) { /* Make room for all additional bytes. */ respos = str - PyBytes_AS_STRING(res); + if (ressize > PY_SSIZE_T_MAX - repsize - 1) { + Py_DECREF(repunicode); + goto overflow; + } if (_PyBytes_Resize(&res, ressize+repsize-1)) { Py_DECREF(repunicode); goto onError; @@ -6595,9 +6615,15 @@ unicode_encode_ucs1(PyObject *unicode, we won't have to check space for encodable characters) */ respos = str - PyBytes_AS_STRING(res); repsize = PyUnicode_GET_LENGTH(repunicode); - requiredsize = respos+repsize+(size-collend); + requiredsize = respos; + if (requiredsize > PY_SSIZE_T_MAX - repsize) + goto overflow; + requiredsize += repsize; + if (requiredsize > PY_SSIZE_T_MAX - (size - collend)) + goto overflow; + requiredsize += size - collend; if (requiredsize > ressize) { - if (requiredsize<2*ressize) + if (ressize <= PY_SSIZE_T_MAX/2 && requiredsize < 2*ressize) requiredsize = 2*ressize; if (_PyBytes_Resize(&res, requiredsize)) { Py_DECREF(repunicode); @@ -6635,6 +6661,10 @@ unicode_encode_ucs1(PyObject *unicode, Py_XDECREF(exc); return res; + overflow: + PyErr_SetString(PyExc_OverflowError, + "encoded result is too long for a Python string"); + onError: Py_XDECREF(res); Py_XDECREF(errorHandler); |