Issue #8650: Make zlib.[de]compressobj().[de]compress() 64-bit clean.

Raise an OverflowError if the input data is too large, instead of silently
truncating the input and returning an incorrect result.
This commit is contained in:
Nadeem Vawda 2011-05-15 00:19:50 +02:00
parent 84aacf8912
commit 0c3d96ae1d
3 changed files with 39 additions and 14 deletions

View file

@ -420,22 +420,26 @@ PyDoc_STRVAR(comp_compress__doc__,
static PyObject *
PyZlib_objcompress(compobject *self, PyObject *args)
{
int err, inplen;
int err;
unsigned int inplen;
Py_ssize_t length = DEFAULTALLOC;
PyObject *RetVal;
PyObject *RetVal = NULL;
Py_buffer pinput;
Byte *input;
unsigned long start_total_out;
if (!PyArg_ParseTuple(args, "y*:compress", &pinput))
return NULL;
if (pinput.len > UINT_MAX) {
PyErr_SetString(PyExc_OverflowError,
"Size does not fit in an unsigned int");
goto error_outer;
}
input = pinput.buf;
inplen = pinput.len;
if (!(RetVal = PyBytes_FromStringAndSize(NULL, length))) {
PyBuffer_Release(&pinput);
return NULL;
}
if (!(RetVal = PyBytes_FromStringAndSize(NULL, length)))
goto error_outer;
ENTER_ZLIB(self);
@ -484,6 +488,7 @@ PyZlib_objcompress(compobject *self, PyObject *args)
error:
LEAVE_ZLIB(self);
error_outer:
PyBuffer_Release(&pinput);
return RetVal;
}
@ -502,9 +507,10 @@ PyDoc_STRVAR(decomp_decompress__doc__,
static PyObject *
PyZlib_objdecompress(compobject *self, PyObject *args)
{
int err, inplen, max_length = 0;
int err, max_length = 0;
unsigned int inplen;
Py_ssize_t old_length, length = DEFAULTALLOC;
PyObject *RetVal;
PyObject *RetVal = NULL;
Py_buffer pinput;
Byte *input;
unsigned long start_total_out;
@ -512,22 +518,24 @@ PyZlib_objdecompress(compobject *self, PyObject *args)
if (!PyArg_ParseTuple(args, "y*|i:decompress", &pinput,
&max_length))
return NULL;
if (pinput.len > UINT_MAX) {
PyErr_SetString(PyExc_OverflowError,
"Size does not fit in an unsigned int");
goto error_outer;
}
input = pinput.buf;
inplen = pinput.len;
if (max_length < 0) {
PyBuffer_Release(&pinput);
PyErr_SetString(PyExc_ValueError,
"max_length must be greater than zero");
return NULL;
goto error_outer;
}
/* limit amount of data allocated to max_length */
if (max_length && length > max_length)
length = max_length;
if (!(RetVal = PyBytes_FromStringAndSize(NULL, length))) {
PyBuffer_Release(&pinput);
return NULL;
}
if (!(RetVal = PyBytes_FromStringAndSize(NULL, length)))
goto error_outer;
ENTER_ZLIB(self);
@ -621,6 +629,7 @@ PyZlib_objdecompress(compobject *self, PyObject *args)
error:
LEAVE_ZLIB(self);
error_outer:
PyBuffer_Release(&pinput);
return RetVal;
}