blob: 13e0c837b3c6d30ec571bf3c60c696e45b4faf2e (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
--- Modules/stropmodule.c.orig 2008-03-02 20:20:32.000000000 +0100
+++ Modules/stropmodule.c
@@ -214,6 +214,13 @@ strop_joinfields(PyObject *self, PyObjec
return NULL;
}
slen = PyString_GET_SIZE(item);
+ if (slen > INT_MAX - reslen ||
+ seplen > INT_MAX - reslen - seplen) {
+ PyErr_SetString(PyExc_OverflowError,
+ "input too long");
+ Py_DECREF(res);
+ return NULL;
+ }
while (reslen + slen + seplen >= sz) {
if (_PyString_Resize(&res, sz * 2) < 0)
return NULL;
@@ -251,6 +258,14 @@ strop_joinfields(PyObject *self, PyObjec
return NULL;
}
slen = PyString_GET_SIZE(item);
+ if (slen > INT_MAX - reslen ||
+ seplen > INT_MAX - reslen - seplen) {
+ PyErr_SetString(PyExc_OverflowError,
+ "input too long");
+ Py_DECREF(res);
+ Py_XDECREF(item);
+ return NULL;
+ }
while (reslen + slen + seplen >= sz) {
if (_PyString_Resize(&res, sz * 2) < 0) {
Py_DECREF(item);
|
