diff options
| author | Neal Norwitz <nnorwitz@gmail.com> | 2008-07-28 05:06:20 +0000 |
|---|---|---|
| committer | Neal Norwitz <nnorwitz@gmail.com> | 2008-07-28 05:06:20 +0000 |
| commit | 0eeaf27c0975c4d6432bb2204648f279a0f1f512 (patch) | |
| tree | f3ed694017ea35a140cd42a6c7cd910acbcd3355 /Modules | |
| parent | 491f16f78327a118cd2425301facf4f15adaa426 (diff) | |
| download | cpython-0eeaf27c0975c4d6432bb2204648f279a0f1f512.tar.gz | |
Backport code from r65182:
Issue #2620: Overflow checking when allocating or reallocating memory
was not always being done properly in some python types and extension
modules. PyMem_MALLOC, PyMem_REALLOC, PyMem_NEW and PyMem_RESIZE have
all been updated to perform better checks and places in the code that
would previously leak memory on the error path when such an allocation
failed have been fixed.
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/almodule.c | 2 | ||||
| -rw-r--r-- | Modules/arraymodule.c | 8 | ||||
| -rw-r--r-- | Modules/selectmodule.c | 4 |
3 files changed, 10 insertions, 4 deletions
diff --git a/Modules/almodule.c b/Modules/almodule.c index 0a45d2e0c0..e4481cd3c0 100644 --- a/Modules/almodule.c +++ b/Modules/almodule.c @@ -1633,9 +1633,11 @@ al_QueryValues(PyObject *self, PyObject *args) if (nvals < 0) goto cleanup; if (nvals > setsize) { + ALvalue *old_return_set = return_set; setsize = nvals; PyMem_RESIZE(return_set, ALvalue, setsize); if (return_set == NULL) { + return_set = old_return_set; PyErr_NoMemory(); goto cleanup; } diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c index eafea988c9..f262d206a8 100644 --- a/Modules/arraymodule.c +++ b/Modules/arraymodule.c @@ -816,6 +816,7 @@ static int array_do_extend(arrayobject *self, PyObject *bb) { Py_ssize_t size; + char *old_item; if (!array_Check(bb)) return array_iter_extend(self, bb); @@ -831,10 +832,11 @@ array_do_extend(arrayobject *self, PyObject *bb) return -1; } size = self->ob_size + b->ob_size; + old_item = self->ob_item; PyMem_RESIZE(self->ob_item, char, size*self->ob_descr->itemsize); if (self->ob_item == NULL) { - PyObject_Del(self); - PyErr_NoMemory(); + self->ob_item = old_item; + PyErr_NoMemory(); return -1; } memcpy(self->ob_item + self->ob_size*self->ob_descr->itemsize, @@ -886,7 +888,7 @@ array_inplace_repeat(arrayobject *self, Py_ssize_t n) if (size > PY_SSIZE_T_MAX / n) { return PyErr_NoMemory(); } - PyMem_Resize(items, char, n * size); + PyMem_RESIZE(items, char, n * size); if (items == NULL) return PyErr_NoMemory(); p = items; diff --git a/Modules/selectmodule.c b/Modules/selectmodule.c index 9eaae8488c..4deab6fb84 100644 --- a/Modules/selectmodule.c +++ b/Modules/selectmodule.c @@ -349,10 +349,12 @@ update_ufd_array(pollObject *self) { Py_ssize_t i, pos; PyObject *key, *value; + struct pollfd *old_ufds = self->ufds; self->ufd_len = PyDict_Size(self->dict); - PyMem_Resize(self->ufds, struct pollfd, self->ufd_len); + PyMem_RESIZE(self->ufds, struct pollfd, self->ufd_len); if (self->ufds == NULL) { + self->ufds = old_ufds; PyErr_NoMemory(); return 0; } |