From: Andrew M. Kuchling <amk@amk.ca>
Date: Tue, 28 Dec 2004 20:12:31 +0000 (+0000)
Subject: [Bug #1083110] calling .flush() on decompress objects causes a segfault due to an... 
X-Git-Tag: v2.4.1c1~121
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3baa81103377bab28e42e194385231ea85dd3968;p=thirdparty%2FPython%2Fcpython.git

[Bug #1083110] calling .flush() on decompress objects causes a segfault due to an uninitialized pointer: fixes the problem and adds a test case
---

diff --git a/Lib/test/test_zlib.py b/Lib/test/test_zlib.py
index 8683879f192c..b4bf77ea0116 100644
--- a/Lib/test/test_zlib.py
+++ b/Lib/test/test_zlib.py
@@ -290,6 +290,16 @@ class CompressObjectTestCase(unittest.TestCase):
             # if decompressed data is different from the input data, choke.
             self.assertEqual(expanded, data, "17K random source doesn't match")
 
+    def test_empty_flush(self):
+        # Test that calling .flush() on unused objects works.
+        # (Bug #1083110 -- calling .flush() on decompress objects
+        # caused a core dump.)
+
+        co = zlib.compressobj(zlib.Z_BEST_COMPRESSION)
+        self.failUnless(co.flush())  # Returns a zlib header
+        dco = zlib.decompressobj()
+        self.assertEqual(dco.flush(), "") # Returns nothing
+        
 
 def genblock(seed, length, step=1024, generator=random):
     """length-byte stream of random data from a seed (in step-byte blocks)."""
diff --git a/Misc/NEWS b/Misc/NEWS
index 0482f1fb61b4..dca67e33c89f 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -42,6 +42,9 @@ Library
   once when a size argument is given. This prevents a buffer overflow in the
   tokenizer with very long source lines.
 
+- Bug #1083110: ``zlib.decompress.flush()`` would segfault if called immediately
+  after creating the object, without any intervening ``.decompress()`` calls.
+
 
 Build
 -----
diff --git a/Modules/zlibmodule.c b/Modules/zlibmodule.c
index 7fedae7887c8..c3238a068501 100644
--- a/Modules/zlibmodule.c
+++ b/Modules/zlibmodule.c
@@ -301,6 +301,8 @@ PyZlib_compressobj(PyObject *selfptr, PyObject *args)
 	return(NULL);
     self->zst.zalloc = (alloc_func)NULL;
     self->zst.zfree = (free_func)Z_NULL;
+    self->zst.next_in = NULL;
+    self->zst.avail_in = 0;
     err = deflateInit2(&self->zst, level, method, wbits, memLevel, strategy);
     switch(err) {
     case (Z_OK):
@@ -335,6 +337,8 @@ PyZlib_decompressobj(PyObject *selfptr, PyObject *args)
 	return(NULL);
     self->zst.zalloc = (alloc_func)NULL;
     self->zst.zfree = (free_func)Z_NULL;
+    self->zst.next_in = NULL;
+    self->zst.avail_in = 0;
     err = inflateInit2(&self->zst, wbits);
     switch(err) {
     case (Z_OK):
@@ -516,7 +520,7 @@ PyZlib_objdecompress(compobject *self, PyObject *args)
 	Py_END_ALLOW_THREADS
     }
 
-    /* Not all of the compressed data could be accomodated in the output buffer
+    /* Not all of the compressed data could be accommodated in the output buffer
        of specified size. Return the unconsumed tail in an attribute.*/
     if(max_length) {
 	Py_DECREF(self->unconsumed_tail);