From 04a538535361b07728ec767ca9d8a5e84ad7378b Mon Sep 17 00:00:00 2001 From: Benjamin Peterson Date: Sat, 13 Aug 2016 16:47:25 -0700 Subject: [PATCH] fix possible overflow in encode_basestring_ascii (#23369) --- Misc/NEWS | 3 +++ Modules/_json.c | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/Misc/NEWS b/Misc/NEWS index 0aa7ee87c45e..9cb550ad0820 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -29,6 +29,9 @@ Core and Builtins Library ------- +- Issue #23369: Fixed possible integer overflow in + _json.encode_basestring_ascii. + - Issue #27568: Prevent HTTPoxy attack (CVE-2016-1000110). Ignore the HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates that the script is in CGI mode. diff --git a/Modules/_json.c b/Modules/_json.c index fede6b14a17c..c3015460578e 100644 --- a/Modules/_json.c +++ b/Modules/_json.c @@ -211,6 +211,10 @@ ascii_escape_unicode(PyObject *pystr) input_unicode = PyUnicode_AS_UNICODE(pystr); /* One char input can be up to 6 chars output, estimate 4 of these */ + if (input_chars > (PY_SSIZE_T_MAX - 2)/ MAX_EXPANSION) { + PyErr_SetString(PyExc_OverflowError, "string is too long to escape"); + return NULL; + } output_size = 2 + (MIN_EXPANSION * 4) + input_chars; max_output_size = 2 + (input_chars * MAX_EXPANSION); rval = PyString_FromStringAndSize(NULL, output_size); -- 2.47.3