From 1062cf71faa14b90185cf159877083910df10f27 Mon Sep 17 00:00:00 2001 From: "Miss Islington (bot)" <31488909+miss-islington@users.noreply.github.com> Date: Mon, 27 May 2019 17:14:21 -0700 Subject: [PATCH] bpo-36856: Handle possible overflow in faulthandler_stack_overflow (GH-13205) (cherry picked from commit 6236c9823ef3e8e2229b0598d3d8189adf5e00f2) Co-authored-by: Xi Ruoyao --- Modules/faulthandler.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/Modules/faulthandler.c b/Modules/faulthandler.c index ec5192832ce0..0dbd5a3342b0 100644 --- a/Modules/faulthandler.c +++ b/Modules/faulthandler.c @@ -1120,13 +1120,26 @@ faulthandler_stack_overflow(PyObject *self) { size_t depth, size; uintptr_t sp = (uintptr_t)&depth; - uintptr_t stop; + uintptr_t stop, lower_limit, upper_limit; faulthandler_suppress_crash_report(); depth = 0; - stop = stack_overflow(sp - STACK_OVERFLOW_MAX_SIZE, - sp + STACK_OVERFLOW_MAX_SIZE, - &depth); + + if (STACK_OVERFLOW_MAX_SIZE <= sp) { + lower_limit = sp - STACK_OVERFLOW_MAX_SIZE; + } + else { + lower_limit = 0; + } + + if (UINTPTR_MAX - STACK_OVERFLOW_MAX_SIZE >= sp) { + upper_limit = sp + STACK_OVERFLOW_MAX_SIZE; + } + else { + upper_limit = UINTPTR_MAX; + } + + stop = stack_overflow(lower_limit, upper_limit, &depth); if (sp < stop) size = stop - sp; else -- 2.47.3