diff options
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/_ctypes/callproc.c | 2 | ||||
| -rw-r--r-- | Modules/_struct.c | 6 | ||||
| -rw-r--r-- | Modules/arraymodule.c | 16 |
3 files changed, 18 insertions, 6 deletions
diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c index 53677c0..0a305ed 100644 --- a/Modules/_ctypes/callproc.c +++ b/Modules/_ctypes/callproc.c @@ -1815,6 +1815,8 @@ buffer_info(PyObject *self, PyObject *arg) return NULL; } shape = PyTuple_New(dict->ndim); + if (shape == NULL) + return NULL; for (i = 0; i < (int)dict->ndim; ++i) PyTuple_SET_ITEM(shape, i, PyLong_FromSsize_t(dict->shape[i])); diff --git a/Modules/_struct.c b/Modules/_struct.c index e7cbd4b..6be4557 100644 --- a/Modules/_struct.c +++ b/Modules/_struct.c @@ -1383,6 +1383,12 @@ prepare_s(PyStructObject *self) } } + /* check for overflow */ + if ((len + 1) > (PY_SSIZE_T_MAX / sizeof(formatcode))) { + PyErr_NoMemory(); + return -1; + } + self->s_size = size; self->s_len = len; codes = PyMem_MALLOC((len + 1) * sizeof(formatcode)); diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c index da2e9c2..3e26369 100644 --- a/Modules/arraymodule.c +++ b/Modules/arraymodule.c @@ -421,6 +421,9 @@ newarrayobject(PyTypeObject *type, Py_ssize_t size, struct arraydescr *descr) if (op == NULL) { return NULL; } + op->ob_descr = descr; + op->allocated = size; + op->weakreflist = NULL; Py_SIZE(op) = size; if (size <= 0) { op->ob_item = NULL; @@ -428,13 +431,10 @@ newarrayobject(PyTypeObject *type, Py_ssize_t size, struct arraydescr *descr) else { op->ob_item = PyMem_NEW(char, nbytes); if (op->ob_item == NULL) { - PyObject_Del(op); + Py_DECREF(op); return PyErr_NoMemory(); } } - op->ob_descr = descr; - op->allocated = size; - op->weakreflist = NULL; op->ob_exports = 0; return (PyObject *) op; } @@ -808,11 +808,15 @@ array_do_extend(arrayobject *self, PyObject *bb) "can only extend with array of same kind"); return -1; } + if ((Py_SIZE(self) > PY_SSIZE_T_MAX - Py_SIZE(b)) || + ((Py_SIZE(self) + Py_SIZE(b)) > PY_SSIZE_T_MAX / self->ob_descr->itemsize)) { + PyErr_NoMemory(); + return -1; + } size = Py_SIZE(self) + Py_SIZE(b); PyMem_RESIZE(self->ob_item, char, size*self->ob_descr->itemsize); if (self->ob_item == NULL) { - PyObject_Del(self); - PyErr_NoMemory(); + PyErr_NoMemory(); return -1; } memcpy(self->ob_item + Py_SIZE(self)*self->ob_descr->itemsize, |