diff options
author | Martin Panter <vadmium+py@gmail.com> | 2016-07-18 07:53:13 +0000 |
---|---|---|
committer | Martin Panter <vadmium+py@gmail.com> | 2016-07-18 07:53:13 +0000 |
commit | cadf3982de3e76f64975dfa14d08232e4c6a072c (patch) | |
tree | c7f9ba5843f27c45b4e8705a85110f69339b9953 /Objects | |
parent | d22a6d20ef191d60901ca650919d0157449f2d6c (diff) | |
download | cpython-cadf3982de3e76f64975dfa14d08232e4c6a072c.tar.gz |
Issue #27507: Check for integer overflow in bytearray.extend()
Patch by Xiang Zhang.
Diffstat (limited to 'Objects')
-rw-r--r-- | Objects/bytearrayobject.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c index b21acfb3f0..145863575f 100644 --- a/Objects/bytearrayobject.c +++ b/Objects/bytearrayobject.c @@ -2474,7 +2474,17 @@ bytearray_extend(PyByteArrayObject *self, PyObject *iterable_of_ints) Py_DECREF(item); if (len >= buf_size) { - buf_size = len + (len >> 1) + 1; + Py_ssize_t addition; + if (len == PY_SSIZE_T_MAX) { + Py_DECREF(it); + Py_DECREF(bytearray_obj); + return PyErr_NoMemory(); + } + addition = len >> 1; + if (addition > PY_SSIZE_T_MAX - len - 1) + buf_size = PY_SSIZE_T_MAX; + else + buf_size = len + addition + 1; if (PyByteArray_Resize((PyObject *)bytearray_obj, buf_size) < 0) { Py_DECREF(it); Py_DECREF(bytearray_obj); |