Skip to content

Commit bf623ae

Browse files
serhiy-storchakaserhiy-storchaka
authored
bpo-30061: Check if PyObject_Size()/PySequence_Size()/PyMapping_Size() (python#1096)
raised an error. Replace them with using concrete types API that never fails if appropriate.
1 parent c209b70 commit bf623ae

14 files changed

Lines changed: 108 additions & 48 deletions

File tree

‎Lib/test/test_io.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -543,6 +543,22 @@ def test_readline(self):
543543
with self.open(support.TESTFN, "r") as f:
544544
self.assertRaises(TypeError, f.readline, 5.3)
545545

546+
def test_readline_nonsizeable(self):
547+
# Issue #30061
548+
# Crash when readline() returns an object without __len__
549+
class R(self.IOBase):
550+
def readline(self):
551+
return None
552+
self.assertRaises((TypeError, StopIteration), next, R())
553+
554+
def test_next_nonsizeable(self):
555+
# Issue #30061
556+
# Crash when __next__() returns an object without __len__
557+
class R(self.IOBase):
558+
def __next__(self):
559+
return None
560+
self.assertRaises(TypeError, R().readlines, 1)
561+
546562
def test_raw_bytes_io(self):
547563
f = self.BytesIO()
548564
self.write_ops(f)

‎Misc/NEWS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,11 @@ Extension Modules
313313
Library
314314
-------
315315

316+
- bpo-30061: Fixed crashes in IOBase methods __next__() and readlines() when
317+
readline() or __next__() respectively return non-sizeable object.
318+
Fixed possible other errors caused by not checking results of PyObject_Size(),
319+
PySequence_Size(), or PyMapping_Size().
320+
316321
- bpo-10076: Compiled regular expression and match objects in the re module
317322
now support copy.copy() and copy.deepcopy() (they are considered atomic).
318323

‎Modules/_ctypes/_ctypes.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5143,7 +5143,7 @@ comerror_init(PyObject *self, PyObject *args, PyObject *kwds)
51435143
if (!PyArg_ParseTuple(args, "OOO:COMError", &hresult, &text, &details))
51445144
return -1;
51455145

5146-
a = PySequence_GetSlice(args, 1, PySequence_Size(args));
5146+
a = PySequence_GetSlice(args, 1, PyTuple_GET_SIZE(args));
51475147
if (!a)
51485148
return -1;
51495149
status = PyObject_SetAttrString(self, "args", a);

‎Modules/_elementtree.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1878,7 +1878,7 @@ element_ass_subscr(PyObject* self_, PyObject* item, PyObject* value)
18781878
);
18791879
return -1;
18801880
}
1881-
newlen = PySequence_Size(seq);
1881+
newlen = PySequence_Fast_GET_SIZE(seq);
18821882

18831883
if (step != 1 && newlen != slicelen)
18841884
{
@@ -3660,7 +3660,7 @@ _elementtree_XMLParser__setevents_impl(XMLParserObject *self,
36603660
return NULL;
36613661
}
36623662

3663-
for (i = 0; i < PySequence_Size(events_seq); ++i) {
3663+
for (i = 0; i < PySequence_Fast_GET_SIZE(events_seq); ++i) {
36643664
PyObject *event_name_obj = PySequence_Fast_GET_ITEM(events_seq, i);
36653665
const char *event_name = NULL;
36663666
if (PyUnicode_Check(event_name_obj)) {

‎Modules/_io/iobase.c‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -618,7 +618,8 @@ iobase_iternext(PyObject *self)
618618
if (line == NULL)
619619
return NULL;
620620

621-
if (PyObject_Size(line) == 0) {
621+
if (PyObject_Size(line) <= 0) {
622+
/* Error or empty */
622623
Py_DECREF(line);
623624
return NULL;
624625
}
@@ -670,6 +671,7 @@ _io__IOBase_readlines_impl(PyObject *self, Py_ssize_t hint)
670671
}
671672

672673
while (1) {
674+
Py_ssize_t line_length;
673675
PyObject *line = PyIter_Next(it);
674676
if (line == NULL) {
675677
if (PyErr_Occurred()) {
@@ -683,11 +685,14 @@ _io__IOBase_readlines_impl(PyObject *self, Py_ssize_t hint)
683685
Py_DECREF(line);
684686
goto error;
685687
}
686-
length += PyObject_Size(line);
688+
line_length = PyObject_Size(line);
687689
Py_DECREF(line);
688-
689-
if (length > hint)
690+
if (line_length < 0) {
691+
goto error;
692+
}
693+
if (line_length > hint - length)
690694
break;
695+
length += line_length;
691696
}
692697

693698
Py_DECREF(it);

‎Modules/_winapi.c‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -722,17 +722,22 @@ getenvironment(PyObject* environment)
722722
return NULL;
723723
}
724724

725-
envsize = PyMapping_Length(environment);
726-
727725
keys = PyMapping_Keys(environment);
728726
values = PyMapping_Values(environment);
729727
if (!keys || !values)
730728
goto error;
731729

730+
envsize = PySequence_Fast_GET_SIZE(keys);
731+
if (PySequence_Fast_GET_SIZE(values) != envsize) {
732+
PyErr_SetString(PyExc_RuntimeError,
733+
"environment changed size during iteration");
734+
goto error;
735+
}
736+
732737
totalsize = 1; /* trailing null character */
733738
for (i = 0; i < envsize; i++) {
734-
PyObject* key = PyList_GET_ITEM(keys, i);
735-
PyObject* value = PyList_GET_ITEM(values, i);
739+
PyObject* key = PySequence_Fast_GET_ITEM(keys, i);
740+
PyObject* value = PySequence_Fast_GET_ITEM(values, i);
736741

737742
if (! PyUnicode_Check(key) || ! PyUnicode_Check(value)) {
738743
PyErr_SetString(PyExc_TypeError,
@@ -760,8 +765,8 @@ getenvironment(PyObject* environment)
760765
end = buffer + totalsize;
761766

762767
for (i = 0; i < envsize; i++) {
763-
PyObject* key = PyList_GET_ITEM(keys, i);
764-
PyObject* value = PyList_GET_ITEM(values, i);
768+
PyObject* key = PySequence_Fast_GET_ITEM(keys, i);
769+
PyObject* value = PySequence_Fast_GET_ITEM(values, i);
765770
if (!PyUnicode_AsUCS4(key, p, end - p, 0))
766771
goto error;
767772
p += PyUnicode_GET_LENGTH(key);

‎Modules/cjkcodecs/multibytecodec.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1670,6 +1670,9 @@ _multibytecodec_MultibyteStreamWriter_writelines(MultibyteStreamWriterObject *se
16701670
if (r == -1)
16711671
return NULL;
16721672
}
1673+
/* PySequence_Length() can fail */
1674+
if (PyErr_Occurred())
1675+
return NULL;
16731676

16741677
Py_RETURN_NONE;
16751678
}

‎Modules/itertoolsmodule.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4325,7 +4325,7 @@ zip_longest_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
43254325
PyObject *ittuple; /* tuple of iterators */
43264326
PyObject *result;
43274327
PyObject *fillvalue = Py_None;
4328-
Py_ssize_t tuplesize = PySequence_Length(args);
4328+
Py_ssize_t tuplesize;
43294329

43304330
if (kwds != NULL && PyDict_CheckExact(kwds) && PyDict_GET_SIZE(kwds) > 0) {
43314331
fillvalue = PyDict_GetItemString(kwds, "fillvalue");
@@ -4338,6 +4338,7 @@ zip_longest_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
43384338

43394339
/* args must be a tuple */
43404340
assert(PyTuple_Check(args));
4341+
tuplesize = PyTuple_GET_SIZE(args);
43414342

43424343
/* obtain iterators */
43434344
ittuple = PyTuple_New(tuplesize);

‎Modules/posixmodule.c‎

Lines changed: 42 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -6642,14 +6642,17 @@ static PyObject *
66426642
os_setgroups(PyObject *module, PyObject *groups)
66436643
/*[clinic end generated code: output=3fcb32aad58c5ecd input=fa742ca3daf85a7e]*/
66446644
{
6645-
int i, len;
6645+
Py_ssize_t i, len;
66466646
gid_t grouplist[MAX_GROUPS];
66476647

66486648
if (!PySequence_Check(groups)) {
66496649
PyErr_SetString(PyExc_TypeError, "setgroups argument must be a sequence");
66506650
return NULL;
66516651
}
66526652
len = PySequence_Size(groups);
6653+
if (len < 0) {
6654+
return NULL;
6655+
}
66536656
if (len > MAX_GROUPS) {
66546657
PyErr_SetString(PyExc_ValueError, "too many groups");
66556658
return NULL;
@@ -7877,9 +7880,9 @@ os_read_impl(PyObject *module, int fd, Py_ssize_t length)
78777880
#if (defined(HAVE_SENDFILE) && (defined(__FreeBSD__) || defined(__DragonFly__) \
78787881
|| defined(__APPLE__))) || defined(HAVE_READV) || defined(HAVE_WRITEV)
78797882
static Py_ssize_t
7880-
iov_setup(struct iovec **iov, Py_buffer **buf, PyObject *seq, int cnt, int type)
7883+
iov_setup(struct iovec **iov, Py_buffer **buf, PyObject *seq, Py_ssize_t cnt, int type)
78817884
{
7882-
int i, j;
7885+
Py_ssize_t i, j;
78837886
Py_ssize_t blen, total = 0;
78847887

78857888
*iov = PyMem_New(struct iovec, cnt);
@@ -7956,8 +7959,7 @@ static Py_ssize_t
79567959
os_readv_impl(PyObject *module, int fd, PyObject *buffers)
79577960
/*[clinic end generated code: output=792da062d3fcebdb input=e679eb5dbfa0357d]*/
79587961
{
7959-
int cnt;
7960-
Py_ssize_t n;
7962+
Py_ssize_t cnt, n;
79617963
int async_err = 0;
79627964
struct iovec *iov;
79637965
Py_buffer *buf;
@@ -7969,6 +7971,8 @@ os_readv_impl(PyObject *module, int fd, PyObject *buffers)
79697971
}
79707972

79717973
cnt = PySequence_Size(buffers);
7974+
if (cnt < 0)
7975+
return -1;
79727976

79737977
if (iov_setup(&iov, &buf, buffers, cnt, PyBUF_WRITABLE) < 0)
79747978
return -1;
@@ -8107,15 +8111,24 @@ posix_sendfile(PyObject *self, PyObject *args, PyObject *kwdict)
81078111
"sendfile() headers must be a sequence");
81088112
return NULL;
81098113
} else {
8110-
Py_ssize_t i = 0; /* Avoid uninitialized warning */
8111-
sf.hdr_cnt = PySequence_Size(headers);
8112-
if (sf.hdr_cnt > 0 &&
8113-
(i = iov_setup(&(sf.headers), &hbuf,
8114-
headers, sf.hdr_cnt, PyBUF_SIMPLE)) < 0)
8114+
Py_ssize_t i = PySequence_Size(headers);
8115+
if (i < 0)
8116+
return NULL;
8117+
if (i > INT_MAX) {
8118+
PyErr_SetString(PyExc_OverflowError,
8119+
"sendfile() header is too large");
81158120
return NULL;
8121+
}
8122+
if (i > 0) {
8123+
sf.hdr_cnt = (int)i;
8124+
i = iov_setup(&(sf.headers), &hbuf,
8125+
headers, sf.hdr_cnt, PyBUF_SIMPLE);
8126+
if (i < 0)
8127+
return NULL;
81168128
#ifdef __APPLE__
8117-
sbytes += i;
8129+
sbytes += i;
81188130
#endif
8131+
}
81198132
}
81208133
}
81218134
if (trailers != NULL) {
@@ -8124,15 +8137,24 @@ posix_sendfile(PyObject *self, PyObject *args, PyObject *kwdict)
81248137
"sendfile() trailers must be a sequence");
81258138
return NULL;
81268139
} else {
8127-
Py_ssize_t i = 0; /* Avoid uninitialized warning */
8128-
sf.trl_cnt = PySequence_Size(trailers);
8129-
if (sf.trl_cnt > 0 &&
8130-
(i = iov_setup(&(sf.trailers), &tbuf,
8131-
trailers, sf.trl_cnt, PyBUF_SIMPLE)) < 0)
8140+
Py_ssize_t i = PySequence_Size(trailers);
8141+
if (i < 0)
8142+
return NULL;
8143+
if (i > INT_MAX) {
8144+
PyErr_SetString(PyExc_OverflowError,
8145+
"sendfile() trailer is too large");
81328146
return NULL;
8147+
}
8148+
if (i > 0) {
8149+
sf.trl_cnt = (int)i;
8150+
i = iov_setup(&(sf.trailers), &tbuf,
8151+
trailers, sf.trl_cnt, PyBUF_SIMPLE);
8152+
if (i < 0)
8153+
return NULL;
81338154
#ifdef __APPLE__
8134-
sbytes += i;
8155+
sbytes += i;
81358156
#endif
8157+
}
81368158
}
81378159
}
81388160

@@ -8402,7 +8424,7 @@ static Py_ssize_t
84028424
os_writev_impl(PyObject *module, int fd, PyObject *buffers)
84038425
/*[clinic end generated code: output=56565cfac3aac15b input=5b8d17fe4189d2fe]*/
84048426
{
8405-
int cnt;
8427+
Py_ssize_t cnt;
84068428
Py_ssize_t result;
84078429
int async_err = 0;
84088430
struct iovec *iov;
@@ -8414,6 +8436,8 @@ os_writev_impl(PyObject *module, int fd, PyObject *buffers)
84148436
return -1;
84158437
}
84168438
cnt = PySequence_Size(buffers);
8439+
if (cnt < 0)
8440+
return -1;
84178441

84188442
if (iov_setup(&iov, &buf, buffers, cnt, PyBUF_SIMPLE) < 0) {
84198443
return -1;

‎Modules/selectmodule.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2021,8 +2021,8 @@ newKqueue_Object(PyTypeObject *type, SOCKET fd)
20212021
static PyObject *
20222022
kqueue_queue_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
20232023
{
2024-
if ((args != NULL && PyObject_Size(args)) ||
2025-
(kwds != NULL && PyObject_Size(kwds))) {
2024+
if (PyTuple_GET_SIZE(args) ||
2025+
(kwds != NULL && PyDict_GET_SIZE(kwds))) {
20262026
PyErr_SetString(PyExc_ValueError,
20272027
"select.kqueue doesn't accept arguments");
20282028
return NULL;

0 commit comments

Comments
 (0)