diff options
| author | R David Murray <rdmurray@bitdance.com> | 2014-10-12 13:54:48 -0400 |
|---|---|---|
| committer | R David Murray <rdmurray@bitdance.com> | 2014-10-12 13:54:48 -0400 |
| commit | 817905b2393b03e035d2bbfc8d92b7bbeaddb118 (patch) | |
| tree | 7d6a5e458918e5407c975d05a387201b14e142ea /Modules | |
| parent | 4cfb5bee89965c7b85772ee2d0c3bf689acd23b2 (diff) | |
| download | cpython-git-817905b2393b03e035d2bbfc8d92b7bbeaddb118.tar.gz | |
#13096: Fix segfault in CTypes POINTER handling of large values.
Patch by Meador Inge.
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/_ctypes/callproc.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c index dcabbdf361..6cf358cf89 100644 --- a/Modules/_ctypes/callproc.c +++ b/Modules/_ctypes/callproc.c @@ -1672,24 +1672,30 @@ POINTER(PyObject *self, PyObject *cls) } if (PyUnicode_CheckExact(cls)) { char *name = _PyUnicode_AsString(cls); - buf = alloca(strlen(name) + 3 + 1); + buf = PyMem_Malloc(strlen(name) + 3 + 1); + if (buf == NULL) + return PyErr_NoMemory(); sprintf(buf, "LP_%s", name); result = PyObject_CallFunction((PyObject *)Py_TYPE(&PyCPointer_Type), "s(O){}", buf, &PyCPointer_Type); + PyMem_Free(buf); if (result == NULL) return result; key = PyLong_FromVoidPtr(result); } else if (PyType_Check(cls)) { typ = (PyTypeObject *)cls; - buf = alloca(strlen(typ->tp_name) + 3 + 1); + buf = PyMem_Malloc(strlen(typ->tp_name) + 3 + 1); + if (buf == NULL) + return PyErr_NoMemory(); sprintf(buf, "LP_%s", typ->tp_name); result = PyObject_CallFunction((PyObject *)Py_TYPE(&PyCPointer_Type), "s(O){sO}", buf, &PyCPointer_Type, "_type_", cls); + PyMem_Free(buf); if (result == NULL) return result; Py_INCREF(cls); |