[Python-checkins] cpython (2.7): Issue #24613: Calling array.fromstring() with self is no longer allowed
serhiy.storchaka
python-checkins at python.org
Sun Jul 26 07:50:55 CEST 2015
https://hg.python.org/cpython/rev/2d39777f3477
changeset: 97068:2d39777f3477
branch: 2.7
parent: 97065:a789ee93f152
user: Serhiy Storchaka <storchaka at gmail.com>
date: Sun Jul 26 08:49:37 2015 +0300
summary:
Issue #24613: Calling array.fromstring() with self is no longer allowed
to prevent the use-after-free error. Patch by John Leitch.
files:
Lib/test/test_array.py | 1 +
Misc/NEWS | 3 +++
Modules/arraymodule.c | 5 +++++
3 files changed, 9 insertions(+), 0 deletions(-)
diff --git a/Lib/test/test_array.py b/Lib/test/test_array.py
--- a/Lib/test/test_array.py
+++ b/Lib/test/test_array.py
@@ -247,6 +247,7 @@
self.assertRaises(TypeError, a.tostring, 42)
self.assertRaises(TypeError, b.fromstring)
self.assertRaises(TypeError, b.fromstring, 42)
+ self.assertRaises(ValueError, a.fromstring, a)
b.fromstring(a.tostring())
self.assertEqual(a, b)
if a.itemsize>1:
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -34,6 +34,9 @@
Library
-------
+- Issue #24613: Calling array.fromstring() with self is no longer allowed
+ to prevent the use-after-free error. Patch by John Leitch.
+
- Issue #24708: Fix possible integer overflow in strop.replace().
- Issue #24620: Random.setstate() now validates the value of state last element.
diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c
--- a/Modules/arraymodule.c
+++ b/Modules/arraymodule.c
@@ -1380,6 +1380,11 @@
int itemsize = self->ob_descr->itemsize;
if (!PyArg_ParseTuple(args, "s#:fromstring", &str, &n))
return NULL;
+ if (str == self->ob_item) {
+ PyErr_SetString(PyExc_ValueError,
+ "array.fromstring(x): x cannot be self");
+ return NULL;
+ }
if (n % itemsize != 0) {
PyErr_SetString(PyExc_ValueError,
"string length not a multiple of item size");
--
Repository URL: https://hg.python.org/cpython
More information about the Python-checkins
mailing list