[New-bugs-announce] [issue10133] conn_recv_string() broken error handling

Hallvard B Furuseth report at bugs.python.org
Sun Oct 17 22:14:55 CEST 2010

New submission from Hallvard B Furuseth <h.b.furuseth at usit.uio.no>:

Neither conn_recv_string() nor its callers free *newbuffer on error.

The promotion rules break negative 'res' for 64-bit Py_ssize_t
in the (ulength <= buflength) branch:
res = -1 ==> (UINT32)-1 ==> Py_ssize_t 0xffffffff instead of -1.

While I'm writing: The _conn_recvall() calls can be factored out
of the if().

This patch applies to both 3.2a3 and 2.7.  However, the patched failure
cases are untested: I do not know how to test them. It passes make test.

components: IO
files: conn_recv_string_failures.diff
keywords: patch
messages: 118978
nosy: hfuru
priority: normal
severity: normal
status: open
title: conn_recv_string() broken error handling
type: behavior
versions: Python 3.2
Added file: http://bugs.python.org/file19256/conn_recv_string_failures.diff

Python tracker <report at bugs.python.org>

More information about the New-bugs-announce mailing list