diff options
| author | Julian Taylor <juliantaylor108@gmail.com> | 2014-07-06 18:49:21 +0200 |
|---|---|---|
| committer | Julian Taylor <juliantaylor108@gmail.com> | 2014-07-06 18:49:21 +0200 |
| commit | ca397d858be5edaa847115c57a01ef921485e039 (patch) | |
| tree | ca7e33747fec28a7e43f4e83039452a85bed84bf | |
| parent | 94417e42ee604b22e91e8af627270d4a106d09ee (diff) | |
| parent | 4b8c9fd2f6d0df786b31d8e235ccc6c087e9a98c (diff) | |
| download | numpy-ca397d858be5edaa847115c57a01ef921485e039.tar.gz | |
Merge pull request #4839 from juliantaylor/buffer-overflow
BUG: fix buffer overflow in data array of ldexp and frexp
| -rw-r--r-- | numpy/core/src/umath/umathmodule.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/numpy/core/src/umath/umathmodule.c b/numpy/core/src/umath/umathmodule.c index 741037a6b..52aa2e48d 100644 --- a/numpy/core/src/umath/umathmodule.c +++ b/numpy/core/src/umath/umathmodule.c @@ -214,9 +214,6 @@ static PyUFuncGenericFunction frexp_functions[] = { #endif }; -static void * blank3_data[] = { (void *)NULL, (void *)NULL, (void *)NULL}; -static void * blank6_data[] = { (void *)NULL, (void *)NULL, (void *)NULL, - (void *)NULL, (void *)NULL, (void *)NULL}; static char frexp_signatures[] = { #ifdef HAVE_FREXPF NPY_HALF, NPY_HALF, NPY_INT, @@ -227,6 +224,7 @@ static char frexp_signatures[] = { ,NPY_LONGDOUBLE, NPY_LONGDOUBLE, NPY_INT #endif }; +static void * blank_data[12]; #if NPY_SIZEOF_LONG == NPY_SIZEOF_INT #define LDEXP_LONG(typ) typ##_ldexp @@ -357,14 +355,16 @@ InitOtherOperators(PyObject *dictionary) { int num; num = sizeof(frexp_functions) / sizeof(frexp_functions[0]); - f = PyUFunc_FromFuncAndData(frexp_functions, blank3_data, + assert(sizeof(blank_data) / sizeof(blank_data[0]) >= num); + f = PyUFunc_FromFuncAndData(frexp_functions, blank_data, frexp_signatures, num, 1, 2, PyUFunc_None, "frexp", frdoc, 0); PyDict_SetItemString(dictionary, "frexp", f); Py_DECREF(f); num = sizeof(ldexp_functions) / sizeof(ldexp_functions[0]); - f = PyUFunc_FromFuncAndData(ldexp_functions, blank6_data, + assert(sizeof(blank_data) / sizeof(blank_data[0]) >= num); + f = PyUFunc_FromFuncAndData(ldexp_functions, blank_data, ldexp_signatures, num, 2, 1, PyUFunc_None, "ldexp", lddoc, 0); PyDict_SetItemString(dictionary, "ldexp", f); |