Modules/arraymodule.c - Issue 2599: python - fix buffer overflows in unicode processing and elsewhere

Keyboard Shortcuts

	File
u :	up to issue
m :	publish + mail comments
M :	edit review message
j / k :	jump to file after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Enter> :	respond to / edit current comment

	Issue
u :	up to list of issues
m :	publish + mail comments
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue
# :	close issue

	Comment/message editing
<Ctrl> + s :	save comment
<Esc> :	cancel edit

Unified Diff: Modules/arraymodule.c

Issue 2599: python - fix buffer overflows in unicode processing and elsewhere SVN Base: http://svn.python.org/view/*checkout*/python/trunk/

Patch Set: Created 1 year, 4 months ago , Downloaded from: http://bugs.python.org/file10825/issue2620-gps02-patch.txt

Use n/p to move between diff chunks; N/P to move between comments. Please Sign in to add in-line comments.

Jump to:

Index: Modules/arraymodule.c

===================================================================

--- Modules/arraymodule.c (revision 64754)

+++ Modules/arraymodule.c (working copy)

@@ -815,6 +815,7 @@

array_do_extend(arrayobject *self, PyObject *bb)

{

Py_ssize_t size;

+ char *old_item;

if (!array_Check(bb))

return array_iter_extend(self, bb);

@@ -830,8 +831,10 @@

return -1;

}

size = Py_SIZE(self) + Py_SIZE(b);

+ old_item = self->ob_item;

PyMem_RESIZE(self->ob_item, char, size*self->ob_descr->itemsize);

if (self->ob_item == NULL) {

+ self->ob_item = old_item;

PyErr_NoMemory();

return -1;

}

@@ -884,7 +887,7 @@

if (size > PY_SSIZE_T_MAX / n) {

return PyErr_NoMemory();

}

- PyMem_Resize(items, char, n * size);

+ PyMem_RESIZE(items, char, n * size);

if (items == NULL)

return PyErr_NoMemory();

p = items;