From 9209278911c7a82407ece94ee9fdf001ba479121 Mon Sep 17 00:00:00 2001 From: Amaury Forgeot d'Arc Date: Wed, 18 Jun 2008 00:47:36 +0000 Subject: Merged revisions 64114 via svnmerge from svn+ssh://pythondev@svn.python.org/python/trunk ........ r64114 | gregory.p.smith | 2008-06-11 09:41:16 +0200 (mer., 11 juin 2008) | 6 lines Merge in release25-maint r60793: Added checks for integer overflows, contributed by Google. Some are only available if asserts are left in the code, in cases where they can't be triggered from Python code. ........ --- Modules/_csv.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'Modules/_csv.c') diff --git a/Modules/_csv.c b/Modules/_csv.c index c6547120ee..430ccdc5af 100644 --- a/Modules/_csv.c +++ b/Modules/_csv.c @@ -533,6 +533,10 @@ parse_grow_buff(ReaderObj *self) self->field = PyMem_New(Py_UNICODE, self->field_size); } else { + if (self->field_size > INT_MAX / 2) { + PyErr_NoMemory(); + return 0; + } self->field_size *= 2; self->field = PyMem_Resize(self->field, Py_UNICODE, self->field_size); @@ -1038,6 +1042,12 @@ join_append_data(WriterObj *self, Py_UNICODE *field, int quote_empty, static int join_check_rec_size(WriterObj *self, int rec_len) { + + if (rec_len < 0 || rec_len > INT_MAX - MEM_INCR) { + PyErr_NoMemory(); + return 0; + } + if (rec_len > self->rec_size) { if (self->rec_size == 0) { self->rec_size = (rec_len / MEM_INCR + 1) * MEM_INCR; -- cgit v1.2.1