Issue #17710: Fix cPickle raising a SystemError on bogus input.

diff --git a/Lib/pickle.py b/Lib/pickle.py
index 5b95cbaca76027a5f01590b7c6ae39d90671b40e..508e858d816969c00758bf9c2d966626ad22e8ca 100644 (file)
--- a/Lib/pickle.py
+++ b/Lib/pickle.py
@@ -962,7 +962,7 @@ class Unpickler:
         rep = self.readline()[:-1]
         for q in "\"'": # double or single quote
             if rep.startswith(q):
-                if not rep.endswith(q):
+                if len(rep) < 2 or not rep.endswith(q):
                     raise ValueError, "insecure string pickle"
                 rep = rep[len(q):-len(q)]
                 break

diff --git a/Lib/test/pickletester.py b/Lib/test/pickletester.py
index 7f43dfb90bad6bc5354b91c06a20a81fb4685e16..34cafcb7b8602a33b257d2a31905030f24a27a7c 100644 (file)
--- a/Lib/test/pickletester.py
+++ b/Lib/test/pickletester.py
@@ -538,6 +538,8 @@ class AbstractPickleTests(unittest.TestCase):
                     "'abc\"", # open quote and close quote don't match
                     "'abc'   ?", # junk after close quote
                     "'\\'", # trailing backslash
+                    "'",    # issue #17710
+                    "' ",   # issue #17710
                     # some tests of the quoting rules
                     #"'abc\"\''",
                     #"'\\\\a\'\'\'\\\'\\\\\''",

diff --git a/Misc/NEWS b/Misc/NEWS
index 3ccdb10bfa52735fc612dcbf65d90bc2ce973f52..fc817401dfeb32af40a9c99592b587b3ff3d03a4 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -28,6 +28,8 @@ Core and Builtins
 Library
 -------
 
+- Issue #17710: Fix cPickle raising a SystemError on bogus input.
+
 - Issue #17341: Include the invalid name in the error messages from re about
   invalid group names.
 

diff --git a/Modules/cPickle.c b/Modules/cPickle.c
index d74ec5b7bbab1c7e2e9bbe2fd8faa0810d1592db..8145bbf381a098528f5d98623f08726333759399 100644 (file)
--- a/Modules/cPickle.c
+++ b/Modules/cPickle.c
@@ -3643,17 +3643,19 @@ load_string(Unpicklerobject *self)
 
 
     /* Strip outermost quotes */
-    while (s[len-1] <= ' ')
+    while (len > 0 && s[len-1] <= ' ')
         len--;
-    if(s[0]=='"' && s[len-1]=='"'){
+    if (len > 1 && s[0]=='"' && s[len-1]=='"') {
         s[len-1] = '\0';
         p = s + 1 ;
         len -= 2;
-    } else if(s[0]=='\'' && s[len-1]=='\''){
+    }
+    else if (len > 1 && s[0]=='\'' && s[len-1]=='\'') {
         s[len-1] = '\0';
         p = s + 1 ;
         len -= 2;
-    } else
+    }
+    else
         goto insecure;
     /********************************************/