Commit 59b6abd
committed
merge 3.3 (python#27758)
2 files changed
Lines changed: 22 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -13,6 +13,9 @@ Core and Builtins | |||
| 13 | 13 | Library | |
| 14 | 14 | ------- | |
| 15 | 15 | ||
| 16 | + - Issue #27758: Fix possible integer overflow in the _csv module for large record | ||
| 17 | + lengths. | ||
| 18 | + | ||
| 16 | 19 | - Issue #27568: Prevent HTTPoxy attack (CVE-2016-1000110). Ignore the | |
| 17 | 20 | HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates | |
| 18 | 21 | that the script is in CGI mode. | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1016,11 +1016,19 @@ join_append_data(WriterObj *self, unsigned int field_kind, void *field_data, | |||
| 1016 | 1016 | int i; | |
| 1017 | 1017 | Py_ssize_t rec_len; | |
| 1018 | 1018 | ||
| 1019 | - #define ADDCH(c) \ | ||
| 1019 | + #define INCLEN \ | ||
| 1020 | + do {\ | ||
| 1021 | + if (!copy_phase && rec_len == PY_SSIZE_T_MAX) { \ | ||
| 1022 | + goto overflow; \ | ||
| 1023 | + } \ | ||
| 1024 | + rec_len++; \ | ||
| 1025 | + } while(0) | ||
| 1026 | + | ||
| 1027 | + #define ADDCH(c) \ | ||
| 1020 | 1028 | do {\ | |
| 1021 | 1029 | if (copy_phase) \ | |
| 1022 | 1030 | self->rec[rec_len] = c;\ | |
| 1023 | - rec_len++;\ | ||
| 1031 | + INCLEN;\ | ||
| 1024 | 1032 | } while(0) | |
| 1025 | 1033 | ||
| 1026 | 1034 | rec_len = self->rec_len; | |
@@ -1086,11 +1094,18 @@ join_append_data(WriterObj *self, unsigned int field_kind, void *field_data, | |||
| 1086 | 1094 | if (*quoted) { | |
| 1087 | 1095 | if (copy_phase) | |
| 1088 | 1096 | ADDCH(dialect->quotechar); | |
| 1089 | - else | ||
| 1090 | - rec_len += 2; | ||
| 1097 | + else { | ||
| 1098 | + INCLEN; /* starting quote */ | ||
| 1099 | + INCLEN; /* ending quote */ | ||
| 1100 | + } | ||
| 1091 | 1101 | } | |
| 1092 | 1102 | return rec_len; | |
| 1103 | + | ||
| 1104 | + overflow: | ||
| 1105 | + PyErr_NoMemory(); | ||
| 1106 | + return -1; | ||
| 1093 | 1107 | #undef ADDCH | |
| 1108 | + #undef INCLEN | ||
| 1094 | 1109 | } | |
| 1095 | 1110 | ||
| 1096 | 1111 | static int | |
0 commit comments