diff options
author | Benjamin Peterson <benjamin@python.org> | 2014-04-13 22:10:38 -0400 |
---|---|---|
committer | Benjamin Peterson <benjamin@python.org> | 2014-04-13 22:10:38 -0400 |
commit | 0891f6d8cf3fe530731ed814b3793414a9bd6592 (patch) | |
tree | f9653773a1c9a01d6ae2b63b3d3348ccd61e0043 | |
parent | 2e13ea3cc8a8a77ca8607ee8dd0a39c88353aec9 (diff) | |
download | cpython-0891f6d8cf3fe530731ed814b3793414a9bd6592.tar.gz |
in scan_once, prevent the reading of arbitrary memory when passed a negative index
Bug reported by Guido Vranken.
-rw-r--r-- | Lib/json/tests/test_decode.py | 4 | ||||
-rw-r--r-- | Misc/ACKS | 1 | ||||
-rw-r--r-- | Misc/NEWS | 3 | ||||
-rw-r--r-- | Modules/_json.c | 5 |
4 files changed, 12 insertions, 1 deletions
diff --git a/Lib/json/tests/test_decode.py b/Lib/json/tests/test_decode.py index 144ff4113c..a689b36779 100644 --- a/Lib/json/tests/test_decode.py +++ b/Lib/json/tests/test_decode.py @@ -45,5 +45,9 @@ class TestDecode: self.assertEqual(rval, {"key":"value", "k":"v"}) + def test_negative_index(self): + d = self.json.JSONDecoder() + self.assertRaises(ValueError, d.raw_decode, 'a'*42, -50000) + class TestPyDecode(TestDecode, PyTest): pass class TestCDecode(TestDecode, CTest): pass @@ -842,6 +842,7 @@ Kannan Vijayan Kurt Vile Norman Vine Frank Visser +Guido Vranken Niki W. Waibel Wojtek Walczak Charles Waldman @@ -13,6 +13,9 @@ Core and Builtins Library ------- +- Fix arbitrary memory access in JSONDecoder.raw_decode with a negative second + parameter. Bug reported by Guido Vranken. + - Issue #20246: Fix buffer overflow in socket.recvfrom_into. - Issue #19435: Fix directory traversal attack on CGIHttpRequestHandler. diff --git a/Modules/_json.c b/Modules/_json.c index 5ced5c9704..e54b0b94bc 100644 --- a/Modules/_json.c +++ b/Modules/_json.c @@ -902,7 +902,10 @@ scan_once_unicode(PyScannerObject *s, PyObject *pystr, Py_ssize_t idx, Py_ssize_ PyObject *res; Py_UNICODE *str = PyUnicode_AS_UNICODE(pystr); Py_ssize_t length = PyUnicode_GET_SIZE(pystr); - if (idx >= length) { + if (idx < 0) + /* Compatibility with Python version. */ + idx += length; + if (idx < 0 || idx >= length) { PyErr_SetNone(PyExc_StopIteration); return NULL; } |