diff options
Diffstat (limited to 'Modules/stropmodule.c')
| -rw-r--r-- | Modules/stropmodule.c | 19 |
1 files changed, 15 insertions, 4 deletions
diff --git a/Modules/stropmodule.c b/Modules/stropmodule.c index 8b00fed69a..bc609590d4 100644 --- a/Modules/stropmodule.c +++ b/Modules/stropmodule.c @@ -578,7 +578,7 @@ strop_expandtabs(PyObject *self, PyObject *args) char* e; char* p; char* q; - Py_ssize_t i, j; + Py_ssize_t i, j, old_j; PyObject* out; char* string; Py_ssize_t stringlen; @@ -595,12 +595,18 @@ strop_expandtabs(PyObject *self, PyObject *args) } /* First pass: determine size of output string */ - i = j = 0; /* j: current column; i: total of previous lines */ + i = j = old_j = 0; /* j: current column; i: total of previous lines */ e = string + stringlen; for (p = string; p < e; p++) { - if (*p == '\t') + if (*p == '\t') { j += tabsize - (j%tabsize); - else { + if (old_j > j) { + PyErr_SetString(PyExc_OverflowError, + "new string is too long"); + return NULL; + } + old_j = j; + } else { j++; if (*p == '\n') { i += j; @@ -609,6 +615,11 @@ strop_expandtabs(PyObject *self, PyObject *args) } } + if ((i + j) < 0) { + PyErr_SetString(PyExc_OverflowError, "new string is too long"); + return NULL; + } + /* Second pass: create output string and fill it */ out = PyString_FromStringAndSize(NULL, i+j); if (out == NULL) |