diff options
| author | Amaury Forgeot d'Arc <amauryfa@gmail.com> | 2008-11-18 22:27:00 +0000 |
|---|---|---|
| committer | Amaury Forgeot d'Arc <amauryfa@gmail.com> | 2008-11-18 22:27:00 +0000 |
| commit | 83be3d268d0a109eff6bbdd9b453edcac6c6c33f (patch) | |
| tree | 0233350bde088b56b9de5214163b88b2531cb2f3 | |
| parent | 9adae2e7decfe738480e8cd0ec41bae95c053fc8 (diff) | |
| download | cpython-git-83be3d268d0a109eff6bbdd9b453edcac6c6c33f.tar.gz | |
Merged revisions 67266 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/trunk
........
r67266 | amaury.forgeotdarc | 2008-11-18 23:19:37 +0100 (mar., 18 nov. 2008) | 4 lines
#4317: Fix an Array Bounds Read in imageop.rgb2rgb8.
Will backport to 2.4.
........
| -rwxr-xr-x | Lib/test/test_imageop.py | 3 | ||||
| -rw-r--r-- | Misc/NEWS | 2 | ||||
| -rw-r--r-- | Modules/imageop.c | 2 |
3 files changed, 5 insertions, 2 deletions
diff --git a/Lib/test/test_imageop.py b/Lib/test/test_imageop.py index 6deaa348cb..9063b22090 100755 --- a/Lib/test/test_imageop.py +++ b/Lib/test/test_imageop.py @@ -15,6 +15,7 @@ SIZES = (1, 2, 3, 4) _VALUES = (1, 2, 2**10, 2**15-1, 2**15, 2**15+1, 2**31-2, 2**31-1) VALUES = tuple( -x for x in reversed(_VALUES) ) + (0,) + _VALUES AAAAA = "A" * 1024 +MAX_LEN = 2**20 class InputValidationTests(unittest.TestCase): @@ -26,7 +27,7 @@ class InputValidationTests(unittest.TestCase): strlen = abs(width * height) if size: strlen *= size - if strlen < 1024: + if strlen < MAX_LEN: data = "A" * strlen else: data = AAAAA @@ -12,6 +12,8 @@ What's New in Python 2.6.1 alpha 1 Core and Builtins ----------------- +- Issue #4317: Fixed a crash in the imageop.rgb2rgb8() function. + - Issue #4230: If ``__getattr__`` is a descriptor, it now functions correctly. - Issue #4048: The parser module now correctly validates relative imports. diff --git a/Modules/imageop.c b/Modules/imageop.c index 61a0c2f813..8d0d68f71d 100644 --- a/Modules/imageop.c +++ b/Modules/imageop.c @@ -590,7 +590,7 @@ imageop_rgb2rgb8(PyObject *self, PyObject *args) if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) ) return 0; - if ( !check_multiply_size(len*4, x, "x", y, "y", 4) ) + if ( !check_multiply_size(len, x, "x", y, "y", 4) ) return 0; nlen = x*y; if ( !check_multiply(nlen, x, y) ) |