From deef67481c37965474b64c7e703982998c20a654 Mon Sep 17 00:00:00 2001 From: Thomas Wouters Date: Fri, 14 Mar 2008 17:16:59 +0000 Subject: Fix crasher in unpacking assignments with star, where the size constraints weren't checked. --- Python/compile.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'Python') diff --git a/Python/compile.c b/Python/compile.c index af6e0676ba..f415519855 100644 --- a/Python/compile.c +++ b/Python/compile.c @@ -2614,6 +2614,11 @@ compiler_list(struct compiler *c, expr_ty e) for (i = 0; i < n; i++) { expr_ty elt = asdl_seq_GET(e->v.List.elts, i); if (elt->kind == Starred_kind && !seen_star) { + if ((i >= (1 << 8)) || + (n-i-1 >= (INT_MAX >> 8))) + return compiler_error(c, + "too many expressions in " + "star-unpacking assignment"); ADDOP_I(c, UNPACK_EX, (i + ((n-i-1) << 8))); seen_star = 1; asdl_seq_SET(e->v.List.elts, i, elt->v.Starred.value); @@ -2642,6 +2647,11 @@ compiler_tuple(struct compiler *c, expr_ty e) for (i = 0; i < n; i++) { expr_ty elt = asdl_seq_GET(e->v.Tuple.elts, i); if (elt->kind == Starred_kind && !seen_star) { + if ((i >= (1 << 8)) || + (n-i-1 >= (INT_MAX >> 8))) + return compiler_error(c, + "too many expressions in " + "star-unpacking assignment"); ADDOP_I(c, UNPACK_EX, (i + ((n-i-1) << 8))); seen_star = 1; asdl_seq_SET(e->v.Tuple.elts, i, elt->v.Starred.value); -- cgit v1.2.1