[Python-checkins] cpython: Issue #1621: Fix undefined behaviour from signed overflow in get_integer

mark.dickinson python-checkins at python.org
Sat Sep 24 20:11:59 CEST 2011


http://hg.python.org/cpython/rev/5e456e1a9e8c
changeset:   72466:5e456e1a9e8c
user:        Mark Dickinson <mdickinson at enthought.com>
date:        Sat Sep 24 19:11:53 2011 +0100
summary:
  Issue #1621: Fix undefined behaviour from signed overflow in get_integer (stringlib/formatter.h)

files:
  Objects/stringlib/formatter.h |  16 +++++++---------
  1 files changed, 7 insertions(+), 9 deletions(-)


diff --git a/Objects/stringlib/formatter.h b/Objects/stringlib/formatter.h
--- a/Objects/stringlib/formatter.h
+++ b/Objects/stringlib/formatter.h
@@ -73,7 +73,7 @@
 get_integer(STRINGLIB_CHAR **ptr, STRINGLIB_CHAR *end,
                   Py_ssize_t *result)
 {
-    Py_ssize_t accumulator, digitval, oldaccumulator;
+    Py_ssize_t accumulator, digitval;
     int numdigits;
     accumulator = numdigits = 0;
     for (;;(*ptr)++, numdigits++) {
@@ -83,19 +83,17 @@
         if (digitval < 0)
             break;
         /*
-           This trick was copied from old Unicode format code.  It's cute,
-           but would really suck on an old machine with a slow divide
-           implementation.  Fortunately, in the normal case we do not
-           expect too many digits.
+           Detect possible overflow before it happens:
+
+              accumulator * 10 + digitval > PY_SSIZE_T_MAX if and only if
+              accumulator > (PY_SSIZE_T_MAX - digitval) / 10.
         */
-        oldaccumulator = accumulator;
-        accumulator *= 10;
-        if ((accumulator+10)/10 != oldaccumulator+1) {
+        if (accumulator > (PY_SSIZE_T_MAX - digitval) / 10) {
             PyErr_Format(PyExc_ValueError,
                          "Too many decimal digits in format string");
             return -1;
         }
-        accumulator += digitval;
+        accumulator = accumulator * 10 + digitval;
     }
     *result = accumulator;
     return numdigits;

-- 
Repository URL: http://hg.python.org/cpython


More information about the Python-checkins mailing list