[Python-checkins] r75145 - in python/branches/py3k: Lib/test/test_marshal.py Misc/NEWS Python/marshal.c

mark.dickinson python-checkins at python.org
Tue Sep 29 21:21:35 CEST 2009


Author: mark.dickinson
Date: Tue Sep 29 21:21:35 2009
New Revision: 75145

Log:
Merged revisions 75141 via svnmerge from 
svn+ssh://pythondev@svn.python.org/python/trunk

........
  r75141 | mark.dickinson | 2009-09-29 20:01:06 +0100 (Tue, 29 Sep 2009) | 3 lines
  
  Issue #7019:  Unmarshalling of bad long data could produce unnormalized
  PyLongs.  Raise ValueError instead.
........


Modified:
   python/branches/py3k/   (props changed)
   python/branches/py3k/Lib/test/test_marshal.py
   python/branches/py3k/Misc/NEWS
   python/branches/py3k/Python/marshal.c

Modified: python/branches/py3k/Lib/test/test_marshal.py
==============================================================================
--- python/branches/py3k/Lib/test/test_marshal.py	(original)
+++ python/branches/py3k/Lib/test/test_marshal.py	Tue Sep 29 21:21:35 2009
@@ -212,6 +212,11 @@
         testString = 'abc' * size
         marshal.dumps(testString)
 
+    def test_invalid_longs(self):
+        # Issue #7019: marshal.loads shouldn't produce unnormalized PyLongs
+        invalid_string = b'l\x02\x00\x00\x00\x00\x00\x00\x00'
+        self.assertRaises(ValueError, marshal.loads, invalid_string)
+
 
 def test_main():
     support.run_unittest(IntTestCase,

Modified: python/branches/py3k/Misc/NEWS
==============================================================================
--- python/branches/py3k/Misc/NEWS	(original)
+++ python/branches/py3k/Misc/NEWS	Tue Sep 29 21:21:35 2009
@@ -12,6 +12,9 @@
 Core and Builtins
 -----------------
 
+- Issue #7019: Raise ValueError when unmarshalling bad long data, instead
+  of producing internally inconsistent Python longs.
+
 - Issue #6990: Fix threading.local subclasses leaving old state around
   after a reference cycle GC which could be recycled by new locals.
 

Modified: python/branches/py3k/Python/marshal.c
==============================================================================
--- python/branches/py3k/Python/marshal.c	(original)
+++ python/branches/py3k/Python/marshal.c	Tue Sep 29 21:21:35 2009
@@ -553,7 +553,7 @@
 r_PyLong(RFILE *p)
 {
 	PyLongObject *ob;
-	int size, i, j, md;
+	int size, i, j, md, shorts_in_top_digit;
 	long n;
 	digit d;
 
@@ -566,7 +566,8 @@
 		return NULL;
 	}
 
-	size = 1 + (ABS(n)-1) / PyLong_MARSHAL_RATIO;
+	size = 1 + (ABS(n) - 1) / PyLong_MARSHAL_RATIO;
+	shorts_in_top_digit = 1 + (ABS(n) - 1) % PyLong_MARSHAL_RATIO;
 	ob = _PyLong_New(size);
 	if (ob == NULL)
 		return NULL;
@@ -583,12 +584,21 @@
 		ob->ob_digit[i] = d;
 	}
 	d = 0;
-	for (j=0; j < (ABS(n)-1)%PyLong_MARSHAL_RATIO + 1; j++) {
+	for (j=0; j < shorts_in_top_digit; j++) {
 		md = r_short(p);
 		if (md < 0 || md > PyLong_MARSHAL_BASE)
 			goto bad_digit;
+		/* topmost marshal digit should be nonzero */
+		if (md == 0 && j == shorts_in_top_digit - 1) {
+			Py_DECREF(ob);
+			PyErr_SetString(PyExc_ValueError,
+				"bad marshal data (unnormalized long data)");
+			return NULL;
+		}
 		d += (digit)md << j*PyLong_MARSHAL_SHIFT;
 	}
+	/* top digit should be nonzero, else the resulting PyLong won't be
+	   normalized */
 	ob->ob_digit[size-1] = d;
 	return (PyObject *)ob;
   bad_digit:


More information about the Python-checkins mailing list