From 3ce5d9207e66d61d4b0502cf47ed2d2bcdd2212f Mon Sep 17 00:00:00 2001 From: Neal Norwitz Date: Sun, 24 Aug 2008 07:08:55 +0000 Subject: Closes release blocker #3627. Merged revisions 65335 via svnmerge from svn+ssh://pythondev@svn.python.org/python/trunk TESTED=./python -E -tt ./Lib/test/regrtest.py -uall (both debug and opt) ........ r65335 | neal.norwitz | 2008-07-31 10:17:14 -0700 (Thu, 31 Jul 2008) | 1 line Security patches from Apple: prevent int overflow when allocating memory ........ --- Objects/bytearrayobject.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'Objects/bytearrayobject.c') diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c index da11249235..201d294e8a 100644 --- a/Objects/bytearrayobject.c +++ b/Objects/bytearrayobject.c @@ -121,6 +121,11 @@ PyByteArray_FromStringAndSize(const char *bytes, Py_ssize_t size) return NULL; } + /* Prevent buffer overflow when setting alloc to size+1. */ + if (size == PY_SSIZE_T_MAX) { + return PyErr_NoMemory(); + } + new = PyObject_New(PyByteArrayObject, &PyByteArray_Type); if (new == NULL) return NULL; -- cgit v1.2.1