diff options
| author | Andrew M. Kuchling <amk@amk.ca> | 2005-06-09 17:53:27 +0000 |
|---|---|---|
| committer | Andrew M. Kuchling <amk@amk.ca> | 2005-06-09 17:53:27 +0000 |
| commit | 5b484dbd56597dbaf7a691394122a32465ae713a (patch) | |
| tree | 1e11f1d969c461cf9928e7a8ee6e4b20b68a7091 /Modules | |
| parent | 95605a3c54e96836152859fc08f7c18d3d6ed2b4 (diff) | |
| download | cpython-5b484dbd56597dbaf7a691394122a32465ae713a.tar.gz | |
[Bug #1200134] Fix buffer overflow by constraining size of .getstr(), .instr() to size of allocated buffer
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/_cursesmodule.c | 22 |
1 files changed, 13 insertions, 9 deletions
diff --git a/Modules/_cursesmodule.c b/Modules/_cursesmodule.c index 7847d3934f..2e14abb779 100644 --- a/Modules/_cursesmodule.c +++ b/Modules/_cursesmodule.c @@ -162,6 +162,10 @@ static int initialisedcolors = FALSE; "must call start_color() first"); \ return 0; } +#ifndef MIN +#define MIN(x,y) ((x) < (y) ? (x) : (y)) +#endif + /* Utility Functions */ /* @@ -801,21 +805,21 @@ PyCursesWindow_GetStr(PyCursesWindowObject *self, PyObject *args) switch (PyTuple_Size(args)) { case 0: Py_BEGIN_ALLOW_THREADS - rtn2 = wgetstr(self->win,rtn); + rtn2 = wgetnstr(self->win,rtn, 1023); Py_END_ALLOW_THREADS break; case 1: if (!PyArg_ParseTuple(args,"i;n", &n)) return NULL; Py_BEGIN_ALLOW_THREADS - rtn2 = wgetnstr(self->win,rtn,n); + rtn2 = wgetnstr(self->win,rtn,MIN(n, 1023)); Py_END_ALLOW_THREADS break; case 2: if (!PyArg_ParseTuple(args,"ii;y,x",&y,&x)) return NULL; Py_BEGIN_ALLOW_THREADS - rtn2 = mvwgetstr(self->win,y,x,rtn); + rtn2 = mvwgetnstr(self->win,y,x,rtn, 1023); Py_END_ALLOW_THREADS break; case 3: @@ -825,11 +829,11 @@ PyCursesWindow_GetStr(PyCursesWindowObject *self, PyObject *args) /* Untested */ Py_BEGIN_ALLOW_THREADS rtn2 = wmove(self->win,y,x)==ERR ? ERR : - wgetnstr(self->win, rtn, n); + wgetnstr(self->win, rtn, MIN(n, 1023)); Py_END_ALLOW_THREADS #else Py_BEGIN_ALLOW_THREADS - rtn2 = mvwgetnstr(self->win, y, x, rtn, n); + rtn2 = mvwgetnstr(self->win, y, x, rtn, MIN(n, 1023)); Py_END_ALLOW_THREADS #endif break; @@ -962,22 +966,22 @@ PyCursesWindow_InStr(PyCursesWindowObject *self, PyObject *args) switch (PyTuple_Size(args)) { case 0: - rtn2 = winstr(self->win,rtn); + rtn2 = winnstr(self->win,rtn, 1023); break; case 1: if (!PyArg_ParseTuple(args,"i;n", &n)) return NULL; - rtn2 = winnstr(self->win,rtn,n); + rtn2 = winnstr(self->win,rtn,MIN(n,1023)); break; case 2: if (!PyArg_ParseTuple(args,"ii;y,x",&y,&x)) return NULL; - rtn2 = mvwinstr(self->win,y,x,rtn); + rtn2 = mvwinnstr(self->win,y,x,rtn,1023); break; case 3: if (!PyArg_ParseTuple(args, "iii;y,x,n", &y, &x, &n)) return NULL; - rtn2 = mvwinnstr(self->win, y, x, rtn, n); + rtn2 = mvwinnstr(self->win, y, x, rtn, MIN(n,1023)); break; default: PyErr_SetString(PyExc_TypeError, "instr requires 0 or 3 arguments"); |