From cf74c1996e084aa840db0782da833f640a3923e3 Mon Sep 17 00:00:00 2001 From: Serhiy Storchaka Date: Sun, 26 Jul 2015 08:49:37 +0300 Subject: Issue #24613: Calling array.fromstring() with self is no longer allowed to prevent the use-after-free error. Patch by John Leitch. --- Lib/test/test_array.py | 1 + Misc/NEWS | 3 +++ Modules/arraymodule.c | 5 +++++ 3 files changed, 9 insertions(+) diff --git a/Lib/test/test_array.py b/Lib/test/test_array.py index 105cf73..9f5c09d 100644 --- a/Lib/test/test_array.py +++ b/Lib/test/test_array.py @@ -247,6 +247,7 @@ class BaseTest(unittest.TestCase): self.assertRaises(TypeError, a.tostring, 42) self.assertRaises(TypeError, b.fromstring) self.assertRaises(TypeError, b.fromstring, 42) + self.assertRaises(ValueError, a.fromstring, a) b.fromstring(a.tostring()) self.assertEqual(a, b) if a.itemsize>1: diff --git a/Misc/NEWS b/Misc/NEWS index 273b116..2fd418d 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -34,6 +34,9 @@ Core and Builtins Library ------- +- Issue #24613: Calling array.fromstring() with self is no longer allowed + to prevent the use-after-free error. Patch by John Leitch. + - Issue #24708: Fix possible integer overflow in strop.replace(). - Issue #24620: Random.setstate() now validates the value of state last element. diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c index 3ed8a33..1d1f0d3 100644 --- a/Modules/arraymodule.c +++ b/Modules/arraymodule.c @@ -1380,6 +1380,11 @@ array_fromstring(arrayobject *self, PyObject *args) int itemsize = self->ob_descr->itemsize; if (!PyArg_ParseTuple(args, "s#:fromstring", &str, &n)) return NULL; + if (str == self->ob_item) { + PyErr_SetString(PyExc_ValueError, + "array.fromstring(x): x cannot be self"); + return NULL; + } if (n % itemsize != 0) { PyErr_SetString(PyExc_ValueError, "string length not a multiple of item size"); -- cgit v0.12