check the result of PyByteArray_Resize in readline() (closes #27211)

diff --git a/Misc/NEWS b/Misc/NEWS
index 309cb62d8568e2104238cc0281fcb0df5cf03519..71a9209a0a3316a2e9f92082369ef0fb4b2c7112 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -89,6 +89,8 @@ Core and Builtins
 Library
 -------
 
+- Issue #27211: Fix possible memory corruption in io.IOBase.readline().
+
 - Issue #27114: Fix SSLContext._load_windows_store_certs fails with
   PermissionError
 

diff --git a/Modules/_io/iobase.c b/Modules/_io/iobase.c
index ab6911ddcda99b2bec380db069a7768b3a9d50e1..61756d0d2a6a69ab13185cd0ec82494bd936aa84 100644 (file)
--- a/Modules/_io/iobase.c
+++ b/Modules/_io/iobase.c
@@ -529,7 +529,10 @@ iobase_readline(PyObject *self, PyObject *args)
         }
 
         old_size = PyByteArray_GET_SIZE(buffer);
-        PyByteArray_Resize(buffer, old_size + PyBytes_GET_SIZE(b));
+        if (PyByteArray_Resize(buffer, old_size + PyBytes_GET_SIZE(b)) < 0) {
+            Py_DECREF(b);
+            goto fail;
+        }
         memcpy(PyByteArray_AS_STRING(buffer) + old_size,
                PyBytes_AS_STRING(b), PyBytes_GET_SIZE(b));