Issue #24467: Fixed possible buffer over-read in bytearray. The bytearray

object now always allocates place for trailing null byte and it's buffer now
is always null-terminated.

1 files changed, 25 insertions, 17 deletions

diff --git a/Python/errors.c b/Python/errors.c
index b0ad9aa58b..1172c59047 100644
--- a/Python/errors.c
+++ b/Python/errors.c
@@ -74,11 +74,11 @@ PyErr_SetObject(PyObject *exception, PyObject *value)
         if (value == NULL || !PyExceptionInstance_Check(value)) {
             /* We must normalize the value right now */
             PyObject *args, *fixed_value;
-#ifdef Py_DEBUG
-            /* in debug mode, PyEval_EvalFrameEx() fails with an assertion
-               error if an exception is set when it is called */
+
+            /* Issue #23571: PyEval_CallObject() must not be called with an
+               exception set */
             PyErr_Clear();
-#endif
+
             if (value == NULL || value == Py_None)
                 args = PyTuple_New(0);
             else if (PyTuple_Check(value)) {
@@ -773,34 +773,38 @@ PyErr_BadInternalCall(void)
 #define PyErr_BadInternalCall() _PyErr_BadInternalCall(__FILE__, __LINE__)
 
 
+PyObject *
+PyErr_FormatV(PyObject *exception, const char *format, va_list vargs)
+{
+    PyObject* string;
+
+    /* Issue #23571: PyUnicode_FromFormatV() must not be called with an
+       exception set, it calls arbitrary Python code like PyObject_Repr() */
+    PyErr_Clear();
+
+    string = PyUnicode_FromFormatV(format, vargs);
+
+    PyErr_SetObject(exception, string);
+    Py_XDECREF(string);
+    return NULL;
+}
+
 
 PyObject *
 PyErr_Format(PyObject *exception, const char *format, ...)
 {
     va_list vargs;
-    PyObject* string;
-
 #ifdef HAVE_STDARG_PROTOTYPES
     va_start(vargs, format);
 #else
     va_start(vargs);
 #endif
-
-#ifdef Py_DEBUG
-    /* in debug mode, PyEval_EvalFrameEx() fails with an assertion error
-       if an exception is set when it is called */
-    PyErr_Clear();
-#endif
-
-    string = PyUnicode_FromFormatV(format, vargs);
-    PyErr_SetObject(exception, string);
-    Py_XDECREF(string);
+    PyErr_FormatV(exception, format, vargs);
     va_end(vargs);
     return NULL;
 }
 
 
-
 PyObject *
 PyErr_NewException(const char *name, PyObject *base, PyObject *dict)
 {
@@ -1121,6 +1125,10 @@ PyErr_ProgramTextObject(PyObject *filename, int lineno)
     if (filename == NULL || lineno <= 0)
         return NULL;
     fp = _Py_fopen_obj(filename, "r" PY_STDIOTEXTMODE);
+    if (fp == NULL) {
+        PyErr_Clear();
+        return NULL;
+    }
     return err_programtext(fp, lineno);
 }