From 8ce6806498be8aa8ae4bd3d3d83624766557ffad Mon Sep 17 00:00:00 2001 From: Benjamin Peterson Date: Mon, 9 Feb 2015 20:58:12 -0500 Subject: add overflow checking (closes #23361) --- Misc/NEWS | 2 ++ Modules/_winapi.c | 14 ++++++++++++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/Misc/NEWS b/Misc/NEWS index 5e1dbf0..7d1dfb8 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -16,6 +16,8 @@ Core and Builtins Library ------- +- Issue #23361: Fix possible overflow in Windows subprocess creation code. + - Issue #23363: Fix possible overflow in itertools.permutations. - Issue #23364: Fix possible overflow in itertools.product. diff --git a/Modules/_winapi.c b/Modules/_winapi.c index c53d55a..5257a1e 100644 --- a/Modules/_winapi.c +++ b/Modules/_winapi.c @@ -513,13 +513,23 @@ getenvironment(PyObject* environment) "environment can only contain strings"); goto error; } + if (totalsize > PY_SSIZE_T_MAX - PyUnicode_GET_LENGTH(key) - 1) { + PyErr_SetString(PyExc_OverflowError, "environment too long"); + goto error; + } totalsize += PyUnicode_GET_LENGTH(key) + 1; /* +1 for '=' */ + if (totalsize > PY_SSIZE_T_MAX - PyUnicode_GET_LENGTH(value) - 1) { + PyErr_SetString(PyExc_OverflowError, "environment too long"); + goto error; + } totalsize += PyUnicode_GET_LENGTH(value) + 1; /* +1 for '\0' */ } - buffer = PyMem_Malloc(totalsize * sizeof(Py_UCS4)); - if (! buffer) + buffer = PyMem_NEW(Py_UCS4, totalsize); + if (! buffer) { + PyErr_NoMemory(); goto error; + } p = buffer; end = buffer + totalsize; -- cgit v0.12