There was an error while loading. Please reload this page.
1 parent e945052 commit 3dec84fCopy full SHA for 3dec84f
2 files changed
Misc/NEWS.d/next/C API/2019-10-21-09-24-03.bpo-38540.314N_T.rst
@@ -0,0 +1,3 @@
1
+Fixed possible leak in :c:func:`PyArg_Parse` and similar functions for
2
+format units ``"es#"`` and ``"et#"`` when the macro
3
+:c:macro:`PY_SSIZE_T_CLEAN` is not defined.
Python/getargs.c
@@ -1176,7 +1176,19 @@ convertsimple(PyObject *arg, const char **p_format, va_list *p_va, int flags,
1176
trailing 0-byte
1177
1178
*/
1179
- FETCH_SIZE;
+ int *q = NULL; Py_ssize_t *q2 = NULL;
1180
+ if (flags & FLAG_SIZE_T) {
1181
+ q2 = va_arg(*p_va, Py_ssize_t*);
1182
+ }
1183
+ else {
1184
+ if (PyErr_WarnEx(PyExc_DeprecationWarning,
1185
+ "PY_SSIZE_T_CLEAN will be required for '#' formats", 1))
1186
+ {
1187
+ Py_DECREF(s);
1188
+ return NULL;
1189
1190
+ q = va_arg(*p_va, int*);
1191
1192
1193
format++;
1194
if (q == NULL && q2 == NULL) {
@@ -1209,7 +1221,19 @@ convertsimple(PyObject *arg, const char **p_format, va_list *p_va, int flags,
1209
1221
}
1210
1222
1211
1223
memcpy(*buffer, ptr, size+1);
1212
- STORE_SIZE(size);
1224
+
1225
1226
+ *q2 = size;
1227
1228
1229
+ if (INT_MAX < size) {
1230
1231
+ PyErr_SetString(PyExc_OverflowError,
1232
+ "size does not fit in an int");
1233
+ return converterr("", arg, msgbuf, bufsize);
1234
1235
+ *q = (int)size;
1236
1213
1237
} else {
1214
1238
/* Using a 0-terminated buffer:
1215
1239
0 commit comments