From 8ce6806498be8aa8ae4bd3d3d83624766557ffad Mon Sep 17 00:00:00 2001 From: Benjamin Peterson Date: Mon, 9 Feb 2015 20:58:12 -0500 Subject: add overflow checking (closes #23361) --- Modules/_winapi.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) (limited to 'Modules/_winapi.c') diff --git a/Modules/_winapi.c b/Modules/_winapi.c index c53d55a535..5257a1e615 100644 --- a/Modules/_winapi.c +++ b/Modules/_winapi.c @@ -513,13 +513,23 @@ getenvironment(PyObject* environment) "environment can only contain strings"); goto error; } + if (totalsize > PY_SSIZE_T_MAX - PyUnicode_GET_LENGTH(key) - 1) { + PyErr_SetString(PyExc_OverflowError, "environment too long"); + goto error; + } totalsize += PyUnicode_GET_LENGTH(key) + 1; /* +1 for '=' */ + if (totalsize > PY_SSIZE_T_MAX - PyUnicode_GET_LENGTH(value) - 1) { + PyErr_SetString(PyExc_OverflowError, "environment too long"); + goto error; + } totalsize += PyUnicode_GET_LENGTH(value) + 1; /* +1 for '\0' */ } - buffer = PyMem_Malloc(totalsize * sizeof(Py_UCS4)); - if (! buffer) + buffer = PyMem_NEW(Py_UCS4, totalsize); + if (! buffer) { + PyErr_NoMemory(); goto error; + } p = buffer; end = buffer + totalsize; -- cgit v1.2.1