Update of /cvsroot/python/python/dist/src/PC In directory sc8-pr-cvs1:/tmp/cvs-serv9905 Modified Files: _winreg.c Log Message: Remove all uses of alloca() from this module. The alloca() return value isn't checked, and it *is* possible that a very large alloca() call is made, e.g. when a large registry value is being read. I don't know if alloca() in that case returns NULL or returns a pointer pointing outside the stack, and I don't want to know -- I've simply replaced all calls to alloca() with either PyMem_Malloc() or PyString_FromStringAndSize(NULL,) as appropriate, followed by a size check. This addresses SF buf 851056. Will backport to 2.3 next. Index: _winreg.c =================================================================== RCS file: /cvsroot/python/python/dist/src/PC/_winreg.c,v retrieving revision 1.14 retrieving revision 1.15 diff -C2 -d -r1.14 -r1.15 *** _winreg.c 15 Jan 2003 23:38:15 -0000 1.14 --- _winreg.c 30 Nov 2003 22:01:43 -0000 1.15 *************** *** 1032,1035 **** --- 1032,1036 ---- int index; long rc; + PyObject *retStr; char *retBuf; DWORD len; *************** *** 1046,1054 **** "RegQueryInfoKey"); ++len; /* include null terminator */ ! retBuf = (char *)alloca(len); ! if ((rc = RegEnumKey(hKey, index, retBuf, len)) != ERROR_SUCCESS) return PyErr_SetFromWindowsErrWithFunction(rc, "RegEnumKey"); ! return Py_BuildValue("s", retBuf); } --- 1047,1061 ---- "RegQueryInfoKey"); ++len; /* include null terminator */ ! retStr = PyString_FromStringAndSize(NULL, len); ! if (retStr == NULL) ! return NULL; ! retBuf = PyString_AS_STRING(retStr); ! if ((rc = RegEnumKey(hKey, index, retBuf, len)) != ERROR_SUCCESS) { ! Py_DECREF(retStr); return PyErr_SetFromWindowsErrWithFunction(rc, "RegEnumKey"); ! } ! _PyString_Resize(&retStr, strlen(retBuf)); ! return retStr; } *************** *** 1081,1086 **** ++retValueSize; /* include null terminators */ ++retDataSize; ! retValueBuf = (char *)alloca(retValueSize); ! retDataBuf = (char *)alloca(retDataSize); Py_BEGIN_ALLOW_THREADS --- 1088,1099 ---- ++retValueSize; /* include null terminators */ ++retDataSize; ! retValueBuf = (char *)PyMem_Malloc(retValueSize); ! if (retValueBuf == NULL) ! return PyErr_NoMemory(); ! retDataBuf = (char *)PyMem_Malloc(retDataSize); ! if (retDataBuf == NULL) { ! PyMem_Free(retValueBuf); ! return PyErr_NoMemory(); ! } Py_BEGIN_ALLOW_THREADS *************** *** 1095,1106 **** Py_END_ALLOW_THREADS ! if (rc != ERROR_SUCCESS) ! return PyErr_SetFromWindowsErrWithFunction(rc, ! "PyRegEnumValue"); obData = Reg2Py(retDataBuf, retDataSize, typ); ! if (obData == NULL) ! return NULL; retVal = Py_BuildValue("sOi", retValueBuf, obData, typ); Py_DECREF(obData); return retVal; } --- 1108,1126 ---- Py_END_ALLOW_THREADS ! if (rc != ERROR_SUCCESS) { ! retVal = PyErr_SetFromWindowsErrWithFunction(rc, ! "PyRegEnumValue"); ! goto fail; ! } obData = Reg2Py(retDataBuf, retDataSize, typ); ! if (obData == NULL) { ! retVal = NULL; ! goto fail; ! } retVal = Py_BuildValue("sOi", retValueBuf, obData, typ); Py_DECREF(obData); + fail: + PyMem_Free(retValueBuf); + PyMem_Free(retDataBuf); return retVal; } *************** *** 1207,1214 **** PyObject *obKey; char *subKey; - long rc; char *retBuf; long bufSize = 0; if (!PyArg_ParseTuple(args, "Oz:QueryValue", &obKey, &subKey)) return NULL; --- 1227,1235 ---- PyObject *obKey; char *subKey; long rc; + PyObject *retStr; char *retBuf; long bufSize = 0; + if (!PyArg_ParseTuple(args, "Oz:QueryValue", &obKey, &subKey)) return NULL; *************** *** 1220,1229 **** return PyErr_SetFromWindowsErrWithFunction(rc, "RegQueryValue"); ! retBuf = (char *)alloca(bufSize); if ((rc = RegQueryValue(hKey, subKey, retBuf, &bufSize)) ! != ERROR_SUCCESS) return PyErr_SetFromWindowsErrWithFunction(rc, "RegQueryValue"); ! return Py_BuildValue("s", retBuf); } --- 1241,1256 ---- return PyErr_SetFromWindowsErrWithFunction(rc, "RegQueryValue"); ! retStr = PyString_FromStringAndSize(NULL, bufSize); ! if (retStr == NULL) ! return NULL; ! retBuf = PyString_AS_STRING(retStr); if ((rc = RegQueryValue(hKey, subKey, retBuf, &bufSize)) ! != ERROR_SUCCESS) { ! Py_DECREF(retStr); return PyErr_SetFromWindowsErrWithFunction(rc, "RegQueryValue"); ! } ! _PyString_Resize(&retStr, strlen(retBuf)); ! return retStr; } *************** *** 1253,1263 **** return PyErr_SetFromWindowsErrWithFunction(rc, "RegQueryValueEx"); ! retBuf = (char *)alloca(bufSize); if ((rc = RegQueryValueEx(hKey, valueName, NULL, &typ, (BYTE *)retBuf, &bufSize)) ! != ERROR_SUCCESS) return PyErr_SetFromWindowsErrWithFunction(rc, "RegQueryValueEx"); obData = Reg2Py(retBuf, bufSize, typ); if (obData == NULL) return NULL; --- 1280,1295 ---- return PyErr_SetFromWindowsErrWithFunction(rc, "RegQueryValueEx"); ! retBuf = (char *)PyMem_Malloc(bufSize); ! if (retBuf == NULL) ! return PyErr_NoMemory(); if ((rc = RegQueryValueEx(hKey, valueName, NULL, &typ, (BYTE *)retBuf, &bufSize)) ! != ERROR_SUCCESS) { ! PyMem_Free(retBuf); return PyErr_SetFromWindowsErrWithFunction(rc, "RegQueryValueEx"); + } obData = Reg2Py(retBuf, bufSize, typ); + PyMem_Free((void *)retBuf); if (obData == NULL) return NULL;