summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBenjamin Peterson <benjamin@python.org>2015-02-09 20:58:12 -0500
committerBenjamin Peterson <benjamin@python.org>2015-02-09 20:58:12 -0500
commit8ce6806498be8aa8ae4bd3d3d83624766557ffad (patch)
treecaebafee8484d324214281a56fb3c6cbbc469c26 /Modules/_winapi.c
parentIssues #23363, #23364, #23365, #23366: Fixed itertools overflow tests. (diff)
downloadcpython-8ce6806498be8aa8ae4bd3d3d83624766557ffad.tar.gz
cpython-8ce6806498be8aa8ae4bd3d3d83624766557ffad.tar.bz2
cpython-8ce6806498be8aa8ae4bd3d3d83624766557ffad.zip
add overflow checking (closes #23361)
Diffstat (limited to 'Modules/_winapi.c')
-rw-r--r--Modules/_winapi.c14
1 files changed, 12 insertions, 2 deletions
diff --git a/Modules/_winapi.c b/Modules/_winapi.c
index c53d55a535f..5257a1e6152 100644
--- a/Modules/_winapi.c
+++ b/Modules/_winapi.c
@@ -513,13 +513,23 @@ getenvironment(PyObject* environment)
"environment can only contain strings");
goto error;
}
+ if (totalsize > PY_SSIZE_T_MAX - PyUnicode_GET_LENGTH(key) - 1) {
+ PyErr_SetString(PyExc_OverflowError, "environment too long");
+ goto error;
+ }
totalsize += PyUnicode_GET_LENGTH(key) + 1; /* +1 for '=' */
+ if (totalsize > PY_SSIZE_T_MAX - PyUnicode_GET_LENGTH(value) - 1) {
+ PyErr_SetString(PyExc_OverflowError, "environment too long");
+ goto error;
+ }
totalsize += PyUnicode_GET_LENGTH(value) + 1; /* +1 for '\0' */
}
- buffer = PyMem_Malloc(totalsize * sizeof(Py_UCS4));
- if (! buffer)
+ buffer = PyMem_NEW(Py_UCS4, totalsize);
+ if (! buffer) {
+ PyErr_NoMemory();
goto error;
+ }
p = buffer;
end = buffer + totalsize;