diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2015-07-30 14:28:48 +1200 |
|---|---|---|
| committer | Stefan Metzmacher <metze@samba.org> | 2015-08-24 23:46:22 +0200 |
| commit | e3cf25bdc04795f884fe2a4ce0605d5175b45e93 (patch) | |
| tree | 5bf63fb1fc663ca2e41721bc027e3ad867c66cd5 /pidl/lib | |
| parent | bed29f3c92861fb2b83ad03a5c759061e1c31eba (diff) | |
| download | samba-e3cf25bdc04795f884fe2a4ce0605d5175b45e93.tar.gz | |
pidl: Assert that python arrays will not overflow the C array
We do not write network services in Python, so this is not a security issue, but would cause
a crash or other odd behaviour if the length was changed
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11430
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Diffstat (limited to 'pidl/lib')
| -rw-r--r-- | pidl/lib/Parse/Pidl/Samba4/Python.pm | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/pidl/lib/Parse/Pidl/Samba4/Python.pm b/pidl/lib/Parse/Pidl/Samba4/Python.pm index a84c6f6ba1e..ad9ff88fd58 100644 --- a/pidl/lib/Parse/Pidl/Samba4/Python.pm +++ b/pidl/lib/Parse/Pidl/Samba4/Python.pm @@ -1223,6 +1223,13 @@ sub ConvertObjectFromPythonLevel($$$$$$$$) $self->pidl("$var_name = talloc_array_ptrtype($mem_ctx, $var_name, PyList_GET_SIZE($py_var));"); $self->pidl("if (!$var_name) { $fail; }"); $self->pidl("talloc_set_name_const($var_name, \"ARRAY: $var_name\");"); + } else { + $self->pidl("if (ARRAY_SIZE($var_name) != PyList_GET_SIZE($py_var)) {"); + $self->indent; + $self->pidl("PyErr_Format(PyExc_TypeError, \"Expected list of type %s, length %zu, got %zd\", Py_TYPE($py_var)->tp_name, ARRAY_SIZE($var_name), PyList_GET_SIZE($py_var));"); + $self->pidl("$fail"); + $self->deindent; + $self->pidl("}"); } $self->pidl("for ($counter = 0; $counter < PyList_GET_SIZE($py_var); $counter++) {"); $self->indent; |