[Python-checkins] bpo-34087: Fix buffer overflow in int(s) and similar functions (GH-8274)
Miss Islington (bot)
webhook-mailer at python.org
Fri Jul 13 23:58:17 EDT 2018
https://github.com/python/cpython/commit/c721472fb83d1f7c7606bcf33ba2d42d6127a764
commit: c721472fb83d1f7c7606bcf33ba2d42d6127a764
branch: 3.7
author: Miss Islington (bot) <31488909+miss-islington at users.noreply.github.com>
committer: GitHub <noreply at github.com>
date: 2018-07-13T20:58:12-07:00
summary:
bpo-34087: Fix buffer overflow in int(s) and similar functions (GH-8274)
`_PyUnicode_TransformDecimalAndSpaceToASCII()` missed trailing NUL char.
It caused buffer overflow in `_Py_string_to_number_with_underscores()`.
This bug is introduced in 9b6c60cb.
(cherry picked from commit 16dfca4d829e45f36e71bf43f83226659ce49315)
Co-authored-by: INADA Naoki <methane at users.noreply.github.com>
files:
A Misc/NEWS.d/next/Core and Builtins/2018-07-13-22-09-55.bpo-34087.I1Bxfc.rst
M Lib/test/test_complex.py
M Lib/test/test_float.py
M Lib/test/test_long.py
M Objects/unicodeobject.c
M Python/pystrtod.c
diff --git a/Lib/test/test_complex.py b/Lib/test/test_complex.py
index 2d883c5348ea..21c6eaed6054 100644
--- a/Lib/test/test_complex.py
+++ b/Lib/test/test_complex.py
@@ -345,6 +345,9 @@ def split_zeros(x):
self.assertEqual(type(complex("1"*500)), complex)
# check whitespace processing
self.assertEqual(complex('\N{EM SPACE}(\N{EN SPACE}1+1j ) '), 1+1j)
+ # Invalid unicode string
+ # See bpo-34087
+ self.assertRaises(ValueError, complex, '\u3053\u3093\u306b\u3061\u306f')
class EvilExc(Exception):
pass
diff --git a/Lib/test/test_float.py b/Lib/test/test_float.py
index 17174dd295df..06ea90c207f5 100644
--- a/Lib/test/test_float.py
+++ b/Lib/test/test_float.py
@@ -60,6 +60,9 @@ def test_float(self):
# extra long strings should not be a problem
float(b'.' + b'1'*1000)
float('.' + '1'*1000)
+ # Invalid unicode string
+ # See bpo-34087
+ self.assertRaises(ValueError, float, '\u3053\u3093\u306b\u3061\u306f')
def test_underscores(self):
for lit in VALID_UNDERSCORE_LITERALS:
diff --git a/Lib/test/test_long.py b/Lib/test/test_long.py
index cc48259e35fb..8472889d48ba 100644
--- a/Lib/test/test_long.py
+++ b/Lib/test/test_long.py
@@ -373,6 +373,10 @@ def test_long(self):
for base in invalid_bases:
self.assertRaises(ValueError, int, '42', base)
+ # Invalid unicode string
+ # See bpo-34087
+ self.assertRaises(ValueError, int, '\u3053\u3093\u306b\u3061\u306f')
+
def test_conversion(self):
diff --git a/Misc/NEWS.d/next/Core and Builtins/2018-07-13-22-09-55.bpo-34087.I1Bxfc.rst b/Misc/NEWS.d/next/Core and Builtins/2018-07-13-22-09-55.bpo-34087.I1Bxfc.rst
new file mode 100644
index 000000000000..5147395fa217
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2018-07-13-22-09-55.bpo-34087.I1Bxfc.rst
@@ -0,0 +1 @@
+Fix buffer overflow while converting unicode to numeric values.
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index d5e7d10b1759..5d605abd0327 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -9076,6 +9076,7 @@ _PyUnicode_TransformDecimalAndSpaceToASCII(PyObject *unicode)
int decimal = Py_UNICODE_TODECIMAL(ch);
if (decimal < 0) {
out[i] = '?';
+ out[i+1] = '\0';
_PyUnicode_LENGTH(result) = i + 1;
break;
}
@@ -9083,6 +9084,7 @@ _PyUnicode_TransformDecimalAndSpaceToASCII(PyObject *unicode)
}
}
+ assert(_PyUnicode_CheckConsistency(result, 1));
return result;
}
diff --git a/Python/pystrtod.c b/Python/pystrtod.c
index 9bf936386210..141a47a8999c 100644
--- a/Python/pystrtod.c
+++ b/Python/pystrtod.c
@@ -391,6 +391,8 @@ _Py_string_to_number_with_underscores(
char *dup, *end;
PyObject *result;
+ assert(s[orig_len] == '\0');
+
if (strchr(s, '_') == NULL) {
return innerfunc(s, orig_len, arg);
}
More information about the Python-checkins
mailing list