From fd0a3bce6e917b5853c809a309c1513acc176f56 Mon Sep 17 00:00:00 2001 From: "Miss Islington (bot)" <31488909+miss-islington@users.noreply.github.com> Date: Sun, 28 Oct 2018 13:59:13 -0700 Subject: bpo-35090: Fix potential division by zero in allocator wrappers (GH-10174) * Fix potential division by zero in BZ2_Malloc() * Avoid division by zero in PyLzma_Malloc() * Avoid division by zero and integer overflow in PyZlib_Malloc() Reported by Svace static analyzer. (cherry picked from commit 3d4fabb2a424cb04ae446ebe4428090c386f45a5) Co-authored-by: Alexey Izbyshev --- Modules/_bz2module.c | 4 ++-- Modules/_lzmamodule.c | 2 +- Modules/zlibmodule.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/Modules/_bz2module.c b/Modules/_bz2module.c index 3f55599..fe06953 100644 --- a/Modules/_bz2module.c +++ b/Modules/_bz2module.c @@ -288,11 +288,11 @@ BZ2_Malloc(void* ctx, int items, int size) { if (items < 0 || size < 0) return NULL; - if ((size_t)items > (size_t)PY_SSIZE_T_MAX / (size_t)size) + if (size != 0 && (size_t)items > (size_t)PY_SSIZE_T_MAX / (size_t)size) return NULL; /* PyMem_Malloc() cannot be used: compress() and decompress() release the GIL */ - return PyMem_RawMalloc(items * size); + return PyMem_RawMalloc((size_t)items * (size_t)size); } static void diff --git a/Modules/_lzmamodule.c b/Modules/_lzmamodule.c index c265507..3d3645a 100644 --- a/Modules/_lzmamodule.c +++ b/Modules/_lzmamodule.c @@ -119,7 +119,7 @@ catch_lzma_error(lzma_ret lzret) static void* PyLzma_Malloc(void *opaque, size_t items, size_t size) { - if (items > (size_t)PY_SSIZE_T_MAX / size) + if (size != 0 && items > (size_t)PY_SSIZE_T_MAX / size) return NULL; /* PyMem_Malloc() cannot be used: the GIL is not held when lzma_code() is called */ diff --git a/Modules/zlibmodule.c b/Modules/zlibmodule.c index a20dcd6..dd7eb4f 100644 --- a/Modules/zlibmodule.c +++ b/Modules/zlibmodule.c @@ -126,11 +126,11 @@ newcompobject(PyTypeObject *type) static void* PyZlib_Malloc(voidpf ctx, uInt items, uInt size) { - if (items > (size_t)PY_SSIZE_T_MAX / size) + if (size != 0 && items > (size_t)PY_SSIZE_T_MAX / size) return NULL; /* PyMem_Malloc() cannot be used: the GIL is not held when inflate() and deflate() are called */ - return PyMem_RawMalloc(items * size); + return PyMem_RawMalloc((size_t)items * (size_t)size); } static void -- cgit v0.12