diff options
Diffstat (limited to 'Modules/stropmodule.c')
| -rw-r--r-- | Modules/stropmodule.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/Modules/stropmodule.c b/Modules/stropmodule.c index bc60959..2d88474 100644 --- a/Modules/stropmodule.c +++ b/Modules/stropmodule.c @@ -216,6 +216,13 @@ strop_joinfields(PyObject *self, PyObject *args) return NULL; } slen = PyString_GET_SIZE(item); + if (slen > PY_SSIZE_T_MAX - reslen || + seplen > PY_SSIZE_T_MAX - reslen - seplen) { + PyErr_SetString(PyExc_OverflowError, + "input too long"); + Py_DECREF(res); + return NULL; + } while (reslen + slen + seplen >= sz) { if (_PyString_Resize(&res, sz * 2) < 0) return NULL; @@ -253,6 +260,14 @@ strop_joinfields(PyObject *self, PyObject *args) return NULL; } slen = PyString_GET_SIZE(item); + if (slen > PY_SSIZE_T_MAX - reslen || + seplen > PY_SSIZE_T_MAX - reslen - seplen) { + PyErr_SetString(PyExc_OverflowError, + "input too long"); + Py_DECREF(res); + Py_XDECREF(item); + return NULL; + } while (reslen + slen + seplen >= sz) { if (_PyString_Resize(&res, sz * 2) < 0) { Py_DECREF(item); |