diff options
| author | Serhiy Storchaka <storchaka@gmail.com> | 2014-10-04 14:15:49 +0300 |
|---|---|---|
| committer | Serhiy Storchaka <storchaka@gmail.com> | 2014-10-04 14:15:49 +0300 |
| commit | be1651bd7b70e4dccebc94cc971d6a1694176c5c (patch) | |
| tree | 1f32149a8bd8d2e24e1620a4f1fb7ec35f8c9757 /Python/codecs.c | |
| parent | a134159b19cc692c13b79eb6091ec23a6db187c6 (diff) | |
| download | cpython-be1651bd7b70e4dccebc94cc971d6a1694176c5c.tar.gz | |
Issue #22518: Fixed integer overflow issues in "backslashreplace",
"xmlcharrefreplace", and "surrogatepass" error handlers.
Diffstat (limited to 'Python/codecs.c')
| -rw-r--r-- | Python/codecs.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/Python/codecs.c b/Python/codecs.c index e584accf72..6849c0f9a4 100644 --- a/Python/codecs.c +++ b/Python/codecs.c @@ -773,7 +773,7 @@ PyObject *PyCodec_XMLCharRefReplaceErrors(PyObject *exc) Py_ssize_t end; PyObject *res; unsigned char *outp; - int ressize; + Py_ssize_t ressize; Py_UCS4 ch; if (PyUnicodeEncodeError_GetStart(exc, &start)) return NULL; @@ -781,6 +781,8 @@ PyObject *PyCodec_XMLCharRefReplaceErrors(PyObject *exc) return NULL; if (!(object = PyUnicodeEncodeError_GetObject(exc))) return NULL; + if (end - start > PY_SSIZE_T_MAX / (2+7+1)) + end = start + PY_SSIZE_T_MAX / (2+7+1); for (i = start, ressize = 0; i < end; ++i) { /* object is guaranteed to be "ready" */ ch = PyUnicode_READ_CHAR(object, i); @@ -869,7 +871,7 @@ PyObject *PyCodec_BackslashReplaceErrors(PyObject *exc) Py_ssize_t end; PyObject *res; unsigned char *outp; - int ressize; + Py_ssize_t ressize; Py_UCS4 c; if (PyUnicodeEncodeError_GetStart(exc, &start)) return NULL; @@ -877,6 +879,8 @@ PyObject *PyCodec_BackslashReplaceErrors(PyObject *exc) return NULL; if (!(object = PyUnicodeEncodeError_GetObject(exc))) return NULL; + if (end - start > PY_SSIZE_T_MAX / (1+1+8)) + end = start + PY_SSIZE_T_MAX / (1+1+8); for (i = start, ressize = 0; i < end; ++i) { /* object is guaranteed to be "ready" */ c = PyUnicode_READ_CHAR(object, i); @@ -1023,6 +1027,8 @@ PyCodec_SurrogatePassErrors(PyObject *exc) code = get_standard_encoding(encoding, &bytelength); Py_DECREF(encode); + if (end - start > PY_SSIZE_T_MAX / bytelength) + end = start + PY_SSIZE_T_MAX / bytelength; res = PyBytes_FromStringAndSize(NULL, bytelength*(end-start)); if (!res) { Py_DECREF(object); |