[Python-checkins] r54635 - in python/branches/release25-maint: Lib/test/test_socket.py Misc/NEWS Modules/socketmodule.c

[neal.norwitz]

Author: neal.norwitz
Date: Sat Mar 31 20:56:11 2007
New Revision: 54635

Modified:
   python/branches/release25-maint/Lib/test/test_socket.py
   python/branches/release25-maint/Misc/NEWS
   python/branches/release25-maint/Modules/socketmodule.c
Log:
Backport 54594:
Fix SF #1688393, sock.recvfrom(-24) crashes

Also fix some method names that were copied incorrectly (trunk fixed).



Modified: python/branches/release25-maint/Lib/test/test_socket.py
==============================================================================
--- python/branches/release25-maint/Lib/test/test_socket.py	(original)
+++ python/branches/release25-maint/Lib/test/test_socket.py	Sat Mar 31 20:56:11 2007
@@ -583,6 +583,13 @@
     def _testRecvFrom(self):
         self.cli.sendto(MSG, 0, (HOST, PORT))
 
+    def testRecvFromNegative(self):
+        # Negative lengths passed to recvfrom should give ValueError.
+        self.assertRaises(ValueError, self.serv.recvfrom, -1)
+
+    def _testRecvFromNegative(self):
+        self.cli.sendto(MSG, 0, (HOST, PORT))
+
 class TCPCloserTest(ThreadedTCPSocketTest):
 
     def testClose(self):

Modified: python/branches/release25-maint/Misc/NEWS
==============================================================================
--- python/branches/release25-maint/Misc/NEWS	(original)
+++ python/branches/release25-maint/Misc/NEWS	Sat Mar 31 20:56:11 2007
@@ -134,6 +134,8 @@
 Extension Modules
 -----------------
 
+- Bug #1688393: Prevent crash in socket.recvfrom if length is negative.
+
 - Bug #1622896: fix a rare corner case where the bz2 module raised an
   error in spite of a succesful compression.
 

Modified: python/branches/release25-maint/Modules/socketmodule.c
==============================================================================
--- python/branches/release25-maint/Modules/socketmodule.c	(original)
+++ python/branches/release25-maint/Modules/socketmodule.c	Sat Mar 31 20:56:11 2007
@@ -2356,14 +2356,14 @@
 	int buflen;
 
 	/* Get the buffer's memory */
-	if (!PyArg_ParseTupleAndKeywords(args, kwds, "w#|ii:recv", kwlist,
+	if (!PyArg_ParseTupleAndKeywords(args, kwds, "w#|ii:recv_into", kwlist,
 					 &buf, &buflen, &recvlen, &flags))
 		return NULL;
 	assert(buf != 0 && buflen > 0);
 
 	if (recvlen < 0) {
 		PyErr_SetString(PyExc_ValueError,
-				"negative buffersize in recv");
+				"negative buffersize in recv_into");
 		return NULL;
 	}
 	if (recvlen == 0) {
@@ -2479,6 +2479,12 @@
 	if (!PyArg_ParseTuple(args, "i|i:recvfrom", &recvlen, &flags))
 		return NULL;
 
+	if (recvlen < 0) {
+		PyErr_SetString(PyExc_ValueError,
+				"negative buffersize in recvfrom");
+		return NULL;
+	}
+
 	buf = PyString_FromStringAndSize((char *) 0, recvlen);
 	if (buf == NULL)
 		return NULL;
@@ -2525,14 +2531,15 @@
 
 	PyObject *addr = NULL;
 
-	if (!PyArg_ParseTupleAndKeywords(args, kwds, "w#|ii:recvfrom", kwlist,
-					 &buf, &buflen, &recvlen, &flags))
+	if (!PyArg_ParseTupleAndKeywords(args, kwds, "w#|ii:recvfrom_into",
+					 kwlist, &buf, &buflen,
+					 &recvlen, &flags))
 		return NULL;
 	assert(buf != 0 && buflen > 0);
 
 	if (recvlen < 0) {
 		PyErr_SetString(PyExc_ValueError,
-				"negative buffersize in recv");
+				"negative buffersize in recvfrom_into");
 		return NULL;
 	}
 	if (recvlen == 0) {