From: Johan Liu <akira.lau@hotmail.com>
Date: Fri, 2 Jun 2017 06:33:04 +0000 (+0800)
Subject: bpo-30245: Fix possible overflow when organize struct.pack_into error message (#1682)
X-Git-Tag: v3.7.0a1~701
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=aead53b6ee27915de248b07de509529174aaad21;p=thirdparty%2FPython%2Fcpython.git

bpo-30245: Fix possible overflow when organize struct.pack_into error message (#1682)
---

diff --git a/Lib/test/test_struct.py b/Lib/test/test_struct.py
index 02d50b2d1c37..b2a5f429e0b9 100644
--- a/Lib/test/test_struct.py
+++ b/Lib/test/test_struct.py
@@ -599,6 +599,16 @@ class StructTest(unittest.TestCase):
                 'offset -11 out of range for 10-byte buffer'):
             struct.pack_into('<B', byte_list, -11, 123)
 
+    def test_boundary_error_message_with_large_offset(self):
+        # Test overflows cause by large offset and value size (issue 30245)
+        regex = (
+            r'pack_into requires a buffer of at least ' + str(sys.maxsize + 4) +
+            r' bytes for packing 4 bytes at offset ' + str(sys.maxsize) +
+            r' \(actual buffer size is 10\)'
+        )
+        with self.assertRaisesRegex(struct.error, regex):
+            struct.pack_into('<I', bytearray(10), sys.maxsize, 1)
+
     def test_issue29802(self):
         # When the second argument of struct.unpack() was of wrong type
         # the Struct object was decrefed twice and the reference to
diff --git a/Misc/ACKS b/Misc/ACKS
index bee9eb0e1362..6fe57d548bee 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -921,6 +921,7 @@ Gregor Lingl
 Everett Lipman
 Mirko Liss
 Alexander Liu
+Yuan Liu
 Nick Lockwood
 Stephanie Lockwood
 Martin von Löwis
diff --git a/Misc/NEWS b/Misc/NEWS
index ada74a065119..5066f57e143a 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -345,6 +345,9 @@ Extension Modules
 Library
 -------
 
+- bpo-30245: Fix possible overflow when organize struct.pack_into
+  error message.  Patch by Yuan Liu.
+  
 - bpo-30378: Fix the problem that logging.handlers.SysLogHandler cannot
   handle IPv6 addresses.
 
diff --git a/Modules/_struct.c b/Modules/_struct.c
index 8e1e21986caa..5b74ec5b4923 100644
--- a/Modules/_struct.c
+++ b/Modules/_struct.c
@@ -1929,11 +1929,14 @@ s_pack_into(PyObject *self, PyObject **args, Py_ssize_t nargs, PyObject *kwnames
 
     /* Check boundaries */
     if ((buffer.len - offset) < soself->s_size) {
+        assert(offset >= 0);
+        assert(soself->s_size >= 0);
+
         PyErr_Format(StructError,
-                     "pack_into requires a buffer of at least %zd bytes for "
+                     "pack_into requires a buffer of at least %zu bytes for "
                      "packing %zd bytes at offset %zd "
                      "(actual buffer size is %zd)",
-                     soself->s_size + offset,
+                     (size_t)soself->s_size + (size_t)offset,
                      soself->s_size,
                      offset,
                      buffer.len);