From 5f8f0d67771257e762b6ab1b2eaa807f4608c7f5 Mon Sep 17 00:00:00 2001 From: Nadeem Vawda Date: Sun, 21 Oct 2012 21:13:27 +0200 Subject: Issue #14398: Fix size truncation and overflow bugs in bz2 module. --- Lib/test/test_bz2.py | 40 +++++- Lib/test/testbz2_bigmem.bz2 | Bin 0 -> 3023 bytes Misc/NEWS | 2 + Modules/bz2module.c | 328 ++++++++++++++++++++++++-------------------- 4 files changed, 217 insertions(+), 153 deletions(-) create mode 100644 Lib/test/testbz2_bigmem.bz2 diff --git a/Lib/test/test_bz2.py b/Lib/test/test_bz2.py index be35580..715468a 100644 --- a/Lib/test/test_bz2.py +++ b/Lib/test/test_bz2.py @@ -1,6 +1,6 @@ #!/usr/bin/env python3 from test import support -from test.support import TESTFN +from test.support import TESTFN, _4G, bigmemtest, findfile import unittest from io import BytesIO @@ -25,6 +25,9 @@ class BaseTest(unittest.TestCase): DATA = b'BZh91AY&SY.\xc8N\x18\x00\x01>_\x80\x00\x10@\x02\xff\xf0\x01\x07n\x00?\xe7\xff\xe00\x01\x99\xaa\x00\xc0\x03F\x86\x8c#&\x83F\x9a\x03\x06\xa6\xd0\xa6\x93M\x0fQ\xa7\xa8\x06\x804hh\x12$\x11\xa4i4\xf14S\xd2\x88\xe5\xcd9gd6\x0b\n\xe9\x9b\xd5\x8a\x99\xf7\x08.K\x8ev\xfb\xf7xw\xbb\xdf\xa1\x92\xf1\xdd|/";\xa2\xba\x9f\xd5\xb1#A\xb6\xf6\xb3o\xc9\xc5y\\\xebO\xe7\x85\x9a\xbc\xb6f8\x952\xd5\xd7"%\x89>V,\xf7\xa6z\xe2\x9f\xa3\xdf\x11\x11"\xd6E)I\xa9\x13^\xca\xf3r\xd0\x03U\x922\xf26\xec\xb6\xed\x8b\xc3U\x13\x9d\xc5\x170\xa4\xfa^\x92\xacDF\x8a\x97\xd6\x19\xfe\xdd\xb8\xbd\x1a\x9a\x19\xa3\x80ankR\x8b\xe5\xd83]\xa9\xc6\x08\x82f\xf6\xb9"6l$\xb8j@\xc0\x8a\xb0l1..\xbak\x83ls\x15\xbc\xf4\xc1\x13\xbe\xf8E\xb8\x9d\r\xa8\x9dk\x84\xd3n\xfa\xacQ\x07\xb1%y\xaav\xb4\x08\xe0z\x1b\x16\xf5\x04\xe9\xcc\xb9\x08z\x1en7.G\xfc]\xc9\x14\xe1B@\xbb!8`' DATA_CRLF = b'BZh91AY&SY\xaez\xbbN\x00\x01H\xdf\x80\x00\x12@\x02\xff\xf0\x01\x07n\x00?\xe7\xff\xe0@\x01\xbc\xc6`\x86*\x8d=M\xa9\x9a\x86\xd0L@\x0fI\xa6!\xa1\x13\xc8\x88jdi\x8d@\x03@\x1a\x1a\x0c\x0c\x83 \x00\xc4h2\x19\x01\x82D\x84e\t\xe8\x99\x89\x19\x1ah\x00\r\x1a\x11\xaf\x9b\x0fG\xf5(\x1b\x1f?\t\x12\xcf\xb5\xfc\x95E\x00ps\x89\x12^\xa4\xdd\xa2&\x05(\x87\x04\x98\x89u\xe40%\xb6\x19\'\x8c\xc4\x89\xca\x07\x0e\x1b!\x91UIFU%C\x994!DI\xd2\xfa\xf0\xf1N8W\xde\x13A\xf5\x9cr%?\x9f3;I45A\xd1\x8bT\xb1\xa4\xc7\x8d\x1a\\"\xad\xa1\xabyBg\x15\xb9l\x88\x88\x91k"\x94\xa4\xd4\x89\xae*\xa6\x0b\x10\x0c\xd6\xd4m\xe86\xec\xb5j\x8a\x86j\';\xca.\x01I\xf2\xaaJ\xe8\x88\x8cU+t3\xfb\x0c\n\xa33\x13r2\r\x16\xe0\xb3(\xbf\x1d\x83r\xe7M\xf0D\x1365\xd8\x88\xd3\xa4\x92\xcb2\x06\x04\\\xc1\xb0\xea//\xbek&\xd8\xe6+t\xe5\xa1\x13\xada\x16\xder5"w]\xa2i\xb7[\x97R \xe2IT\xcd;Z\x04dk4\xad\x8a\t\xd3\x81z\x10\xf1:^`\xab\x1f\xc5\xdc\x91N\x14$+\x9e\xae\xd3\x80' + with open(findfile("testbz2_bigmem.bz2"), "rb") as f: + DATA_BIGMEM = f.read() + if has_cmdline_bunzip2: def decompress(self, data): pop = subprocess.Popen("bunzip2", shell=True, @@ -44,6 +47,7 @@ class BaseTest(unittest.TestCase): def decompress(self, data): return bz2.decompress(data) + class BZ2FileTest(BaseTest): "Test BZ2File type miscellaneous methods." @@ -313,6 +317,17 @@ class BZ2CompressorTest(BaseTest): data += bz2c.flush() self.assertEqual(self.decompress(data), self.TEXT) + @bigmemtest(size=_4G, memuse=1.25) + def testBigmem(self, size): + text = b"a" * size + bz2c = bz2.BZ2Compressor() + data = bz2c.compress(text) + bz2c.flush() + del text + text = self.decompress(data) + self.assertEqual(len(text), size) + self.assertEqual(text.strip(b"a"), b"") + + class BZ2DecompressorTest(BaseTest): def test_Constructor(self): self.assertRaises(TypeError, BZ2Decompressor, 42) @@ -351,6 +366,13 @@ class BZ2DecompressorTest(BaseTest): text = bz2d.decompress(self.DATA) self.assertRaises(EOFError, bz2d.decompress, b"anything") + @bigmemtest(size=_4G, memuse=1.25, dry_run=False) + def testBigmem(self, unused_size): + # Issue #14398: decompression fails when output data is >=2GB. + text = bz2.BZ2Decompressor().decompress(self.DATA_BIGMEM) + self.assertEqual(len(text), _4G) + self.assertEqual(text.strip(b"\0"), b"") + class FuncTest(BaseTest): "Test module functions" @@ -374,6 +396,22 @@ class FuncTest(BaseTest): # "Test decompress() function with incomplete data" self.assertRaises(ValueError, bz2.decompress, self.DATA[:-10]) + @bigmemtest(size=_4G, memuse=1.25) + def testCompressBigmem(self, size): + text = b"a" * size + data = bz2.compress(text) + del text + text = self.decompress(data) + self.assertEqual(len(text), size) + self.assertEqual(text.strip(b"a"), b"") + + @bigmemtest(size=_4G, memuse=1.25, dry_run=False) + def testDecompressBigmem(self, unused_size): + # Issue #14398: decompression fails when output data is >=2GB. + text = bz2.decompress(self.DATA_BIGMEM) + self.assertEqual(len(text), _4G) + self.assertEqual(text.strip(b"\0"), b"") + def test_main(): support.run_unittest( BZ2FileTest, diff --git a/Lib/test/testbz2_bigmem.bz2 b/Lib/test/testbz2_bigmem.bz2 new file mode 100644 index 0000000..c9a4616 Binary files /dev/null and b/Lib/test/testbz2_bigmem.bz2 differ diff --git a/Misc/NEWS b/Misc/NEWS index b68970a..5069d47 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -132,6 +132,8 @@ Core and Builtins Library ------- +- Issue #14398: Fix size truncation and overflow bugs in the bz2 module. + - Issue #16220: wsgiref now always calls close() on an iterable response. Patch by Brent Tubbs. diff --git a/Modules/bz2module.c b/Modules/bz2module.c index a671e8d..4795965 100644 --- a/Modules/bz2module.c +++ b/Modules/bz2module.c @@ -41,23 +41,8 @@ typedef fpos_t Py_off_t; #define MODE_READ_EOF 2 #define MODE_WRITE 3 -#define BZ2FileObject_Check(v) (Py_TYPE(v) == &BZ2File_Type) - -#ifdef BZ_CONFIG_ERROR - -#if SIZEOF_LONG >= 8 -#define BZS_TOTAL_OUT(bzs) \ - (((long)bzs->total_out_hi32 << 32) + bzs->total_out_lo32) -#elif SIZEOF_LONG_LONG >= 8 -#define BZS_TOTAL_OUT(bzs) \ - (((PY_LONG_LONG)bzs->total_out_hi32 << 32) + bzs->total_out_lo32) -#else -#define BZS_TOTAL_OUT(bzs) \ - bzs->total_out_lo32 -#endif - -#else /* ! BZ_CONFIG_ERROR */ +#ifndef BZ_CONFIG_ERROR #define BZ2_bzRead bzRead #define BZ2_bzReadOpen bzReadOpen @@ -72,8 +57,6 @@ typedef fpos_t Py_off_t; #define BZ2_bzDecompressInit bzDecompressInit #define BZ2_bzDecompressEnd bzDecompressEnd -#define BZS_TOTAL_OUT(bzs) bzs->total_out - #endif /* ! BZ_CONFIG_ERROR */ @@ -90,11 +73,7 @@ typedef fpos_t Py_off_t; #define RELEASE_LOCK(obj) #endif -/* Bits in f_newlinetypes */ -#define NEWLINE_UNKNOWN 0 /* No newline seen, yet */ -#define NEWLINE_CR 1 /* \r newline seen */ -#define NEWLINE_LF 2 /* \n newline seen */ -#define NEWLINE_CRLF 4 /* \r\n newline seen */ +#define MIN(X, Y) (((X) < (Y)) ? (X) : (Y)) /* ===================================================================== */ /* Structure definitions. */ @@ -228,6 +207,20 @@ Util_NewBufferSize(size_t currentsize) return currentsize + (currentsize >> 3) + 6; } +static int +Util_GrowBuffer(PyObject **buf) +{ + size_t size = PyBytes_GET_SIZE(*buf); + size_t new_size = Util_NewBufferSize(size); + if (new_size > size) { + return _PyBytes_Resize(buf, new_size); + } else { /* overflow */ + PyErr_SetString(PyExc_OverflowError, + "Unable to allocate buffer - output too large"); + return -1; + } +} + /* This is a hacked version of Python's fileobject.c:get_line(). */ static PyObject * Util_GetLine(BZ2FileObject *f, int n) @@ -1418,20 +1411,16 @@ static PyObject * BZ2Comp_compress(BZ2CompObject *self, PyObject *args) { Py_buffer pdata; - char *data; - int datasize; - int bufsize = SMALLCHUNK; - PY_LONG_LONG totalout; + size_t input_left; + size_t output_size = 0; PyObject *ret = NULL; bz_stream *bzs = &self->bzs; int bzerror; if (!PyArg_ParseTuple(args, "y*:compress", &pdata)) return NULL; - data = pdata.buf; - datasize = pdata.len; - if (datasize == 0) { + if (pdata.len == 0) { PyBuffer_Release(&pdata); return PyBytes_FromStringAndSize("", 0); } @@ -1443,41 +1432,51 @@ BZ2Comp_compress(BZ2CompObject *self, PyObject *args) goto error; } - ret = PyBytes_FromStringAndSize(NULL, bufsize); + ret = PyBytes_FromStringAndSize(NULL, SMALLCHUNK); if (!ret) goto error; - bzs->next_in = data; - bzs->avail_in = datasize; - bzs->next_out = BUF(ret); - bzs->avail_out = bufsize; + bzs->next_in = pdata.buf; + bzs->avail_in = MIN(pdata.len, UINT_MAX); + input_left = pdata.len - bzs->avail_in; - totalout = BZS_TOTAL_OUT(bzs); + bzs->next_out = BUF(ret); + bzs->avail_out = PyBytes_GET_SIZE(ret); for (;;) { + char *saved_next_out; + Py_BEGIN_ALLOW_THREADS + saved_next_out = bzs->next_out; bzerror = BZ2_bzCompress(bzs, BZ_RUN); + output_size += bzs->next_out - saved_next_out; Py_END_ALLOW_THREADS + if (bzerror != BZ_RUN_OK) { Util_CatchBZ2Error(bzerror); goto error; } - if (bzs->avail_in == 0) - break; /* no more input data */ + if (bzs->avail_in == 0) { + if (input_left == 0) + break; /* no more input data */ + bzs->avail_in = MIN(input_left, UINT_MAX); + input_left -= bzs->avail_in; + } if (bzs->avail_out == 0) { - bufsize = Util_NewBufferSize(bufsize); - if (_PyBytes_Resize(&ret, bufsize) < 0) { - BZ2_bzCompressEnd(bzs); - goto error; + size_t buffer_left = PyBytes_GET_SIZE(ret) - output_size; + if (buffer_left == 0) { + if (Util_GrowBuffer(&ret) < 0) { + BZ2_bzCompressEnd(bzs); + goto error; + } + bzs->next_out = BUF(ret) + output_size; + buffer_left = PyBytes_GET_SIZE(ret) - output_size; } - bzs->next_out = BUF(ret) + (BZS_TOTAL_OUT(bzs) - - totalout); - bzs->avail_out = bufsize - (bzs->next_out - BUF(ret)); + bzs->avail_out = MIN(buffer_left, UINT_MAX); } } - if (_PyBytes_Resize(&ret, - (Py_ssize_t)(BZS_TOTAL_OUT(bzs) - totalout)) < 0) + if (_PyBytes_Resize(&ret, output_size) < 0) goto error; RELEASE_LOCK(self); @@ -1501,33 +1500,34 @@ You must not use the compressor object after calling this method.\n\ static PyObject * BZ2Comp_flush(BZ2CompObject *self) { - int bufsize = SMALLCHUNK; + size_t output_size = 0; PyObject *ret = NULL; bz_stream *bzs = &self->bzs; - PY_LONG_LONG totalout; int bzerror; ACQUIRE_LOCK(self); if (!self->running) { - PyErr_SetString(PyExc_ValueError, "object was already " - "flushed"); + PyErr_SetString(PyExc_ValueError, "object was already flushed"); goto error; } self->running = 0; - ret = PyBytes_FromStringAndSize(NULL, bufsize); + ret = PyBytes_FromStringAndSize(NULL, SMALLCHUNK); if (!ret) goto error; bzs->next_out = BUF(ret); - bzs->avail_out = bufsize; - - totalout = BZS_TOTAL_OUT(bzs); + bzs->avail_out = PyBytes_GET_SIZE(ret); for (;;) { + char *saved_next_out; + Py_BEGIN_ALLOW_THREADS + saved_next_out = bzs->next_out; bzerror = BZ2_bzCompress(bzs, BZ_FINISH); + output_size += bzs->next_out - saved_next_out; Py_END_ALLOW_THREADS + if (bzerror == BZ_STREAM_END) { break; } else if (bzerror != BZ_FINISH_OK) { @@ -1535,21 +1535,20 @@ BZ2Comp_flush(BZ2CompObject *self) goto error; } if (bzs->avail_out == 0) { - bufsize = Util_NewBufferSize(bufsize); - if (_PyBytes_Resize(&ret, bufsize) < 0) - goto error; - bzs->next_out = BUF(ret); - bzs->next_out = BUF(ret) + (BZS_TOTAL_OUT(bzs) - - totalout); - bzs->avail_out = bufsize - (bzs->next_out - BUF(ret)); + size_t buffer_left = PyBytes_GET_SIZE(ret) - output_size; + if (buffer_left == 0) { + if (Util_GrowBuffer(&ret) < 0) + goto error; + bzs->next_out = BUF(ret) + output_size; + buffer_left = PyBytes_GET_SIZE(ret) - output_size; + } + bzs->avail_out = MIN(buffer_left, UINT_MAX); } } - if (bzs->avail_out != 0) { - if (_PyBytes_Resize(&ret, - (Py_ssize_t)(BZS_TOTAL_OUT(bzs) - totalout)) < 0) + if (output_size != PyBytes_GET_SIZE(ret)) + if (_PyBytes_Resize(&ret, output_size) < 0) goto error; - } RELEASE_LOCK(self); return ret; @@ -1714,18 +1713,14 @@ static PyObject * BZ2Decomp_decompress(BZ2DecompObject *self, PyObject *args) { Py_buffer pdata; - char *data; - int datasize; - int bufsize = SMALLCHUNK; - PY_LONG_LONG totalout; + size_t input_left; + size_t output_size = 0; PyObject *ret = NULL; bz_stream *bzs = &self->bzs; int bzerror; if (!PyArg_ParseTuple(args, "y*:decompress", &pdata)) return NULL; - data = pdata.buf; - datasize = pdata.len; ACQUIRE_LOCK(self); if (!self->running) { @@ -1734,55 +1729,65 @@ BZ2Decomp_decompress(BZ2DecompObject *self, PyObject *args) goto error; } - ret = PyBytes_FromStringAndSize(NULL, bufsize); + ret = PyBytes_FromStringAndSize(NULL, SMALLCHUNK); if (!ret) goto error; - bzs->next_in = data; - bzs->avail_in = datasize; - bzs->next_out = BUF(ret); - bzs->avail_out = bufsize; + bzs->next_in = pdata.buf; + bzs->avail_in = MIN(pdata.len, UINT_MAX); + input_left = pdata.len - bzs->avail_in; - totalout = BZS_TOTAL_OUT(bzs); + bzs->next_out = BUF(ret); + bzs->avail_out = PyBytes_GET_SIZE(ret); for (;;) { + char *saved_next_out; + Py_BEGIN_ALLOW_THREADS + saved_next_out = bzs->next_out; bzerror = BZ2_bzDecompress(bzs); + output_size += bzs->next_out - saved_next_out; Py_END_ALLOW_THREADS + if (bzerror == BZ_STREAM_END) { - if (bzs->avail_in != 0) { + self->running = 0; + input_left += bzs->avail_in; + if (input_left != 0) { Py_DECREF(self->unused_data); self->unused_data = - PyBytes_FromStringAndSize(bzs->next_in, - bzs->avail_in); + PyBytes_FromStringAndSize(bzs->next_in, input_left); + if (self->unused_data == NULL) + goto error; } - self->running = 0; break; } if (bzerror != BZ_OK) { Util_CatchBZ2Error(bzerror); goto error; } - if (bzs->avail_in == 0) - break; /* no more input data */ + if (bzs->avail_in == 0) { + if (input_left == 0) + break; /* no more input data */ + bzs->avail_in = MIN(input_left, UINT_MAX); + input_left -= bzs->avail_in; + } if (bzs->avail_out == 0) { - bufsize = Util_NewBufferSize(bufsize); - if (_PyBytes_Resize(&ret, bufsize) < 0) { - BZ2_bzDecompressEnd(bzs); - goto error; + size_t buffer_left = PyBytes_GET_SIZE(ret) - output_size; + if (buffer_left == 0) { + if (Util_GrowBuffer(&ret) < 0) { + BZ2_bzDecompressEnd(bzs); + goto error; + } + bzs->next_out = BUF(ret) + output_size; + buffer_left = PyBytes_GET_SIZE(ret) - output_size; } - bzs->next_out = BUF(ret); - bzs->next_out = BUF(ret) + (BZS_TOTAL_OUT(bzs) - - totalout); - bzs->avail_out = bufsize - (bzs->next_out - BUF(ret)); + bzs->avail_out = MIN(buffer_left, UINT_MAX); } } - if (bzs->avail_out != 0) { - if (_PyBytes_Resize(&ret, - (Py_ssize_t)(BZS_TOTAL_OUT(bzs) - totalout)) < 0) + if (output_size != PyBytes_GET_SIZE(ret)) + if (_PyBytes_Resize(&ret, output_size) < 0) goto error; - } RELEASE_LOCK(self); PyBuffer_Release(&pdata); @@ -1929,10 +1934,10 @@ static PyObject * bz2_compress(PyObject *self, PyObject *args, PyObject *kwargs) { int compresslevel=9; + int action; Py_buffer pdata; - char *data; - int datasize; - int bufsize; + size_t input_left; + size_t output_size = 0; PyObject *ret = NULL; bz_stream _bzs; bz_stream *bzs = &_bzs; @@ -1943,8 +1948,6 @@ bz2_compress(PyObject *self, PyObject *args, PyObject *kwargs) kwlist, &pdata, &compresslevel)) return NULL; - data = pdata.buf; - datasize = pdata.len; if (compresslevel < 1 || compresslevel > 9) { PyErr_SetString(PyExc_ValueError, @@ -1953,11 +1956,7 @@ bz2_compress(PyObject *self, PyObject *args, PyObject *kwargs) return NULL; } - /* Conforming to bz2 manual, this is large enough to fit compressed - * data in one shot. We will check it later anyway. */ - bufsize = datasize + (datasize/100+1) + 600; - - ret = PyBytes_FromStringAndSize(NULL, bufsize); + ret = PyBytes_FromStringAndSize(NULL, SMALLCHUNK); if (!ret) { PyBuffer_Release(&pdata); return NULL; @@ -1965,10 +1964,12 @@ bz2_compress(PyObject *self, PyObject *args, PyObject *kwargs) memset(bzs, 0, sizeof(bz_stream)); - bzs->next_in = data; - bzs->avail_in = datasize; + bzs->next_in = pdata.buf; + bzs->avail_in = MIN(pdata.len, UINT_MAX); + input_left = pdata.len - bzs->avail_in; + bzs->next_out = BUF(ret); - bzs->avail_out = bufsize; + bzs->avail_out = PyBytes_GET_SIZE(ret); bzerror = BZ2_bzCompressInit(bzs, compresslevel, 0, 0); if (bzerror != BZ_OK) { @@ -1978,38 +1979,53 @@ bz2_compress(PyObject *self, PyObject *args, PyObject *kwargs) return NULL; } + action = BZ_RUN; + for (;;) { + char *saved_next_out; + Py_BEGIN_ALLOW_THREADS - bzerror = BZ2_bzCompress(bzs, BZ_FINISH); + saved_next_out = bzs->next_out; + bzerror = BZ2_bzCompress(bzs, action); + output_size += bzs->next_out - saved_next_out; Py_END_ALLOW_THREADS + if (bzerror == BZ_STREAM_END) { break; - } else if (bzerror != BZ_FINISH_OK) { + } else if (bzerror != BZ_RUN_OK && bzerror != BZ_FINISH_OK) { BZ2_bzCompressEnd(bzs); Util_CatchBZ2Error(bzerror); PyBuffer_Release(&pdata); Py_DECREF(ret); return NULL; } + if (action == BZ_RUN && bzs->avail_in == 0) { + if (input_left == 0) { + action = BZ_FINISH; + } else { + bzs->avail_in = MIN(input_left, UINT_MAX); + input_left -= bzs->avail_in; + } + } if (bzs->avail_out == 0) { - bufsize = Util_NewBufferSize(bufsize); - if (_PyBytes_Resize(&ret, bufsize) < 0) { - BZ2_bzCompressEnd(bzs); - PyBuffer_Release(&pdata); - return NULL; + size_t buffer_left = PyBytes_GET_SIZE(ret) - output_size; + if (buffer_left == 0) { + if (Util_GrowBuffer(&ret) < 0) { + BZ2_bzCompressEnd(bzs); + PyBuffer_Release(&pdata); + return NULL; + } + bzs->next_out = BUF(ret) + output_size; + buffer_left = PyBytes_GET_SIZE(ret) - output_size; } - bzs->next_out = BUF(ret) + BZS_TOTAL_OUT(bzs); - bzs->avail_out = bufsize - (bzs->next_out - BUF(ret)); + bzs->avail_out = MIN(buffer_left, UINT_MAX); } } - if (bzs->avail_out != 0) { - if (_PyBytes_Resize(&ret, (Py_ssize_t)BZS_TOTAL_OUT(bzs)) < 0) { - ret = NULL; - } - } - BZ2_bzCompressEnd(bzs); + if (output_size != PyBytes_GET_SIZE(ret)) + _PyBytes_Resize(&ret, output_size); /* Sets ret to NULL on failure. */ + BZ2_bzCompressEnd(bzs); PyBuffer_Release(&pdata); return ret; } @@ -2025,9 +2041,8 @@ static PyObject * bz2_decompress(PyObject *self, PyObject *args) { Py_buffer pdata; - char *data; - int datasize; - int bufsize = SMALLCHUNK; + size_t input_left; + size_t output_size = 0; PyObject *ret; bz_stream _bzs; bz_stream *bzs = &_bzs; @@ -2035,15 +2050,13 @@ bz2_decompress(PyObject *self, PyObject *args) if (!PyArg_ParseTuple(args, "y*:decompress", &pdata)) return NULL; - data = pdata.buf; - datasize = pdata.len; - if (datasize == 0) { + if (pdata.len == 0) { PyBuffer_Release(&pdata); return PyBytes_FromStringAndSize("", 0); } - ret = PyBytes_FromStringAndSize(NULL, bufsize); + ret = PyBytes_FromStringAndSize(NULL, SMALLCHUNK); if (!ret) { PyBuffer_Release(&pdata); return NULL; @@ -2051,10 +2064,12 @@ bz2_decompress(PyObject *self, PyObject *args) memset(bzs, 0, sizeof(bz_stream)); - bzs->next_in = data; - bzs->avail_in = datasize; + bzs->next_in = pdata.buf; + bzs->avail_in = MIN(pdata.len, UINT_MAX); + input_left = pdata.len - bzs->avail_in; + bzs->next_out = BUF(ret); - bzs->avail_out = bufsize; + bzs->avail_out = PyBytes_GET_SIZE(ret); bzerror = BZ2_bzDecompressInit(bzs, 0, 0); if (bzerror != BZ_OK) { @@ -2065,9 +2080,14 @@ bz2_decompress(PyObject *self, PyObject *args) } for (;;) { + char *saved_next_out; + Py_BEGIN_ALLOW_THREADS + saved_next_out = bzs->next_out; bzerror = BZ2_bzDecompress(bzs); + output_size += bzs->next_out - saved_next_out; Py_END_ALLOW_THREADS + if (bzerror == BZ_STREAM_END) { break; } else if (bzerror != BZ_OK) { @@ -2078,33 +2098,37 @@ bz2_decompress(PyObject *self, PyObject *args) return NULL; } if (bzs->avail_in == 0) { - BZ2_bzDecompressEnd(bzs); - PyErr_SetString(PyExc_ValueError, - "couldn't find end of stream"); - PyBuffer_Release(&pdata); - Py_DECREF(ret); - return NULL; - } - if (bzs->avail_out == 0) { - bufsize = Util_NewBufferSize(bufsize); - if (_PyBytes_Resize(&ret, bufsize) < 0) { + if (input_left == 0) { BZ2_bzDecompressEnd(bzs); + PyErr_SetString(PyExc_ValueError, + "couldn't find end of stream"); PyBuffer_Release(&pdata); + Py_DECREF(ret); return NULL; } - bzs->next_out = BUF(ret) + BZS_TOTAL_OUT(bzs); - bzs->avail_out = bufsize - (bzs->next_out - BUF(ret)); + bzs->avail_in = MIN(input_left, UINT_MAX); + input_left -= bzs->avail_in; } - } - - if (bzs->avail_out != 0) { - if (_PyBytes_Resize(&ret, (Py_ssize_t)BZS_TOTAL_OUT(bzs)) < 0) { - ret = NULL; + if (bzs->avail_out == 0) { + size_t buffer_left = PyBytes_GET_SIZE(ret) - output_size; + if (buffer_left == 0) { + if (Util_GrowBuffer(&ret) < 0) { + BZ2_bzDecompressEnd(bzs); + PyBuffer_Release(&pdata); + return NULL; + } + bzs->next_out = BUF(ret) + output_size; + buffer_left = PyBytes_GET_SIZE(ret) - output_size; + } + bzs->avail_out = MIN(buffer_left, UINT_MAX); } } + + if (output_size != PyBytes_GET_SIZE(ret)) + _PyBytes_Resize(&ret, output_size); /* Sets ret to NULL on failure. */ + BZ2_bzDecompressEnd(bzs); PyBuffer_Release(&pdata); - return ret; } -- cgit v0.12