From: Guido van Rossum <guido@python.org>
Date: Tue, 23 Feb 1999 18:05:22 +0000 (+0000)
Subject: Carefully check for overflow when allocating the memory for fromfile
X-Git-Tag: v1.5.2c1~269
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3791b0de365237b3bdddcc050858a83b8fd97f99;p=thirdparty%2FPython%2Fcpython.git

Carefully check for overflow when allocating the memory for fromfile
-- someone tried to pass in sys.maxint and got bitten by the bogus
calculations.
---

diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c
index 656f5a68af1b..bb0a9edb33b4 100644
--- a/Modules/arraymodule.c
+++ b/Modules/arraymodule.c
@@ -935,8 +935,15 @@ array_fromfile(self, args)
 		char *item = self->ob_item;
 		int itemsize = self->ob_descr->itemsize;
 		int nread;
-		PyMem_RESIZE(item, char, (self->ob_size + n) * itemsize);
+		int newlength;
+		size_t newbytes;
+		/* Be careful here about overflow */
+		if ((newlength = self->ob_size + n) <= 0 ||
+		    (newbytes = newlength * itemsize) / itemsize != newlength)
+			goto nomem;
+		PyMem_RESIZE(item, char, newbytes);
 		if (item == NULL) {
+		  nomem:
 			PyErr_NoMemory();
 			return NULL;
 		}