Issue #8651: PyArg_Parse*() functions raise an OverflowError if the file

doesn't have PY_SSIZE_T_CLEAN define and the size doesn't fit in an int (length
bigger than 2^31-1 bytes).

3 files changed, 31 insertions, 1 deletions

diff --git a/Lib/test/test_xml_etree_c.py b/Lib/test/test_xml_etree_c.py
index 78a6a9241c..474a4b4e18 100644
--- a/Lib/test/test_xml_etree_c.py
+++ b/Lib/test/test_xml_etree_c.py
@@ -1,6 +1,8 @@
 # xml.etree test for cElementTree
 
 from test import test_support
+from test.test_support import precisionbigmemtest, _2G
+import unittest
 
 cET = test_support.import_module('xml.etree.cElementTree')
 
@@ -15,6 +17,20 @@ def sanity():
     """
 
 
+class MiscTests(unittest.TestCase):
+    # Issue #8651.
+    @precisionbigmemtest(size=_2G + 100, memuse=1)
+    def test_length_overflow(self, size):
+        if size < _2G + 100:
+            self.skipTest("not enough free memory, need at least 2 GB")
+        data = b'x' * size
+        parser = cET.XMLParser()
+        try:
+            self.assertRaises(OverflowError, parser.feed, data)
+        finally:
+            data = None
+
+
 def test_main():
     from test import test_xml_etree, test_xml_etree_c
 
diff --git a/Misc/NEWS b/Misc/NEWS
index e26b6ca316..b14a6cb627 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -9,6 +9,10 @@ What's New in Python 2.7.2?
 Core and Builtins
 -----------------
 
+- Issue #8651: PyArg_Parse*() functions raise an OverflowError if the file
+  doesn't have PY_SSIZE_T_CLEAN define and the size doesn't fit in an int
+  (length bigger than 2^31-1 bytes).
+
 - Issue #8651: Fix "z#" format of PyArg_Parse*() function: the size was not
   written if PY_SSIZE_T_CLEAN is defined.
 
diff --git a/Python/getargs.c b/Python/getargs.c
index 02351ed6fa..eccdc9bfb3 100644
--- a/Python/getargs.c
+++ b/Python/getargs.c
@@ -585,7 +585,17 @@ convertsimple(PyObject *arg, const char **p_format, va_list *p_va, int flags,
 #define FETCH_SIZE      int *q=NULL;Py_ssize_t *q2=NULL;\
     if (flags & FLAG_SIZE_T) q2=va_arg(*p_va, Py_ssize_t*); \
     else q=va_arg(*p_va, int*);
-#define STORE_SIZE(s)   if (flags & FLAG_SIZE_T) *q2=s; else *q=s;
+#define STORE_SIZE(s)   \
+    if (flags & FLAG_SIZE_T) \
+        *q2=s; \
+    else { \
+        if (INT_MAX < s) { \
+            PyErr_SetString(PyExc_OverflowError, \
+                "size does not fit in an int"); \
+            return converterr("", arg, msgbuf, bufsize); \
+        } \
+        *q=s; \
+    }
 #define BUFFER_LEN      ((flags & FLAG_SIZE_T) ? *q2:*q)
 
     const char *format = *p_format;