mirrors
/
cpython
mirror of https://github.com/python/cpython.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Issue #29145: Fix overflow checks in str.replace() and str.join(). 

Based on patch by Martin Panter.
This commit is contained in:
Xiang Zhang 2017-01-10 10:52:00 +08:00
parent 18e0a97a1a
commit b0541f4cdf
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Objects/unicodeobject.c
View File

@ -9752,7 +9752,7 @@ PyUnicode_Join(PyObject *separator, PyObject *seq)
use_memcpy = 1; use_memcpy = 1;
#endif #endif
for (i = 0; i < seqlen; i++) { for (i = 0; i < seqlen; i++) {
const Py_ssize_t old_sz = sz; size_t add_sz;
item = items[i]; item = items[i];
if (!PyUnicode_Check(item)) { if (!PyUnicode_Check(item)) {
PyErr_Format(PyExc_TypeError, PyErr_Format(PyExc_TypeError,
@ -9763,16 +9763,18 @@ PyUnicode_Join(PyObject *separator, PyObject *seq)
} }
if (PyUnicode_READY(item) == -1) if (PyUnicode_READY(item) == -1)
goto onError; goto onError;
sz += PyUnicode_GET_LENGTH(item); add_sz = PyUnicode_GET_LENGTH(item);
item_maxchar = PyUnicode_MAX_CHAR_VALUE(item); item_maxchar = PyUnicode_MAX_CHAR_VALUE(item);
maxchar = Py_MAX(maxchar, item_maxchar); maxchar = Py_MAX(maxchar, item_maxchar);
if (i != 0) if (i != 0) {
sz += seplen; add_sz += seplen;
if (sz < old_sz || sz > PY_SSIZE_T_MAX) { }
if (add_sz > (size_t)(PY_SSIZE_T_MAX - sz)) {
PyErr_SetString(PyExc_OverflowError, PyErr_SetString(PyExc_OverflowError,
"join() result is too long for a Python string"); "join() result is too long for a Python string");
goto onError; goto onError;
} }
sz += add_sz;
if (use_memcpy && last_obj != NULL) { if (use_memcpy && last_obj != NULL) {
if (PyUnicode_KIND(last_obj) != PyUnicode_KIND(item)) if (PyUnicode_KIND(last_obj) != PyUnicode_KIND(item))
use_memcpy = 0; use_memcpy = 0;
@ -10418,7 +10420,7 @@ replace(PyObject *self, PyObject *str1,
u = unicode_empty; u = unicode_empty;
goto done; goto done;
} }
if (new_size > (PY_SSIZE_T_MAX >> (rkind-1))) { if (new_size > (PY_SSIZE_T_MAX / rkind)) {
PyErr_SetString(PyExc_OverflowError, PyErr_SetString(PyExc_OverflowError,
"replace string is too long"); "replace string is too long");
goto error; goto error;