[Python-checkins] r62236 - in python/branches/release25-maint: Lib/test/test_zlib.py Modules/zlibmodule.c

[gregory.p.smith]

Author: gregory.p.smith
Date: Wed Apr  9 02:26:44 2008
New Revision: 62236

Modified:
   python/branches/release25-maint/Lib/test/test_zlib.py
   python/branches/release25-maint/Modules/zlibmodule.c
Log:
Merge r62235 from trunk.

Fix zlib crash from zlib.decompressobj().flush(val) when val was not positive.
It tried to allocate negative or zero memory.  That fails.


Modified: python/branches/release25-maint/Lib/test/test_zlib.py
==============================================================================
--- python/branches/release25-maint/Lib/test/test_zlib.py	(original)
+++ python/branches/release25-maint/Lib/test/test_zlib.py	Wed Apr  9 02:26:44 2008
@@ -71,6 +71,11 @@
         # verify failure on building decompress object with bad params
         self.assertRaises(ValueError, zlib.decompressobj, 0)
 
+    def test_decompressobj_badflush(self):
+        # verify failure on calling decompressobj.flush with bad params
+        self.assertRaises(ValueError, zlib.decompressobj().flush, 0)
+        self.assertRaises(ValueError, zlib.decompressobj().flush, -1)
+
 
 
 class CompressTestCase(unittest.TestCase):

Modified: python/branches/release25-maint/Modules/zlibmodule.c
==============================================================================
--- python/branches/release25-maint/Modules/zlibmodule.c	(original)
+++ python/branches/release25-maint/Modules/zlibmodule.c	Wed Apr  9 02:26:44 2008
@@ -774,6 +774,10 @@
 
     if (!PyArg_ParseTuple(args, "|i:flush", &length))
 	return NULL;
+    if (length <= 0) {
+	PyErr_SetString(PyExc_ValueError, "length must be greater than zero");
+	return NULL;
+    }
     if (!(retval = PyString_FromStringAndSize(NULL, length)))
 	return NULL;