Skip to content

Commit 80dc16b

Browse files
gvanrossumgvanrossum
committed
Trent Mick:
Changes the 'b', 'h', and 'i' formatters in PyArg_ParseTuple to raise an Overflow exception if they overflow (previously they just silently overflowed). Changes by Guido: always accept values [0..255] (in addition to [CHAR_MIN..CHAR_MAX]) for 'b' format; changed some spaces into tabs in other code.
1 parent 07bd90e commit 80dc16b

1 file changed

Lines changed: 44 additions & 14 deletions

File tree

‎Python/getargs.c‎

Lines changed: 44 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -471,6 +471,16 @@ convertsimple1(arg, p_format, p_va)
471471
long ival = PyInt_AsLong(arg);
472472
if (ival == -1 && PyErr_Occurred())
473473
return "integer<b>";
474+
else if (ival < CHAR_MIN) {
475+
PyErr_SetString(PyExc_OverflowError,
476+
"byte integer is less than minimum");
477+
return "integer<b>";
478+
}
479+
else if (ival > CHAR_MAX && ival >= 256) {
480+
PyErr_SetString(PyExc_OverflowError,
481+
"byte integer is greater than maximum");
482+
return "integer<b>";
483+
}
474484
else
475485
*p = (char) ival;
476486
break;
@@ -482,6 +492,16 @@ convertsimple1(arg, p_format, p_va)
482492
long ival = PyInt_AsLong(arg);
483493
if (ival == -1 && PyErr_Occurred())
484494
return "integer<h>";
495+
else if (ival < SHRT_MIN) {
496+
PyErr_SetString(PyExc_OverflowError,
497+
"short integer is less than minimum");
498+
return "integer<h>";
499+
}
500+
else if (ival > SHRT_MAX) {
501+
PyErr_SetString(PyExc_OverflowError,
502+
"short integer is greater than maximum");
503+
return "integer<h>";
504+
}
485505
else
486506
*p = (short) ival;
487507
break;
@@ -493,6 +513,16 @@ convertsimple1(arg, p_format, p_va)
493513
long ival = PyInt_AsLong(arg);
494514
if (ival == -1 && PyErr_Occurred())
495515
return "integer<i>";
516+
else if (ival < INT_MIN) {
517+
PyErr_SetString(PyExc_OverflowError,
518+
"integer is less than minimum");
519+
return "integer<i>";
520+
}
521+
else if (ival > INT_MAX) {
522+
PyErr_SetString(PyExc_OverflowError,
523+
"integer is greater than maximum");
524+
return "integer<i>";
525+
}
496526
else
497527
*p = ival;
498528
break;
@@ -572,8 +602,8 @@ convertsimple1(arg, p_format, p_va)
572602
case 's': /* string */
573603
{
574604
if (*format == '#') { /* any buffer-like object */
575-
void **p = (void **)va_arg(*p_va, char **);
576-
PyBufferProcs *pb = arg->ob_type->tp_as_buffer;
605+
void **p = (void **)va_arg(*p_va, char **);
606+
PyBufferProcs *pb = arg->ob_type->tp_as_buffer;
577607
int *q = va_arg(*p_va, int *);
578608
int count;
579609

@@ -589,9 +619,9 @@ convertsimple1(arg, p_format, p_va)
589619
*q = count;
590620
format++;
591621
} else {
592-
char **p = va_arg(*p_va, char **);
622+
char **p = va_arg(*p_va, char **);
593623

594-
if (PyString_Check(arg))
624+
if (PyString_Check(arg))
595625
*p = PyString_AS_STRING(arg);
596626
else if (PyUnicode_Check(arg)) {
597627
arg = _PyUnicode_AsUTF8String(arg, NULL);
@@ -610,8 +640,8 @@ convertsimple1(arg, p_format, p_va)
610640
case 'z': /* string, may be NULL (None) */
611641
{
612642
if (*format == '#') { /* any buffer-like object */
613-
void **p = (void **)va_arg(*p_va, char **);
614-
PyBufferProcs *pb = arg->ob_type->tp_as_buffer;
643+
void **p = (void **)va_arg(*p_va, char **);
644+
PyBufferProcs *pb = arg->ob_type->tp_as_buffer;
615645
int *q = va_arg(*p_va, int *);
616646
int count;
617647

@@ -632,9 +662,9 @@ convertsimple1(arg, p_format, p_va)
632662
}
633663
format++;
634664
} else {
635-
char **p = va_arg(*p_va, char **);
665+
char **p = va_arg(*p_va, char **);
636666

637-
if (arg == Py_None)
667+
if (arg == Py_None)
638668
*p = 0;
639669
else if (PyString_Check(arg))
640670
*p = PyString_AsString(arg);
@@ -780,8 +810,8 @@ convertsimple1(arg, p_format, p_va)
780810
case 'u': /* raw unicode buffer (Py_UNICODE *) */
781811
{
782812
if (*format == '#') { /* any buffer-like object */
783-
void **p = (void **)va_arg(*p_va, char **);
784-
PyBufferProcs *pb = arg->ob_type->tp_as_buffer;
813+
void **p = (void **)va_arg(*p_va, char **);
814+
PyBufferProcs *pb = arg->ob_type->tp_as_buffer;
785815
int *q = va_arg(*p_va, int *);
786816
int count;
787817

@@ -799,9 +829,9 @@ convertsimple1(arg, p_format, p_va)
799829
*q = count/(sizeof(Py_UNICODE));
800830
format++;
801831
} else {
802-
Py_UNICODE **p = va_arg(*p_va, Py_UNICODE **);
832+
Py_UNICODE **p = va_arg(*p_va, Py_UNICODE **);
803833

804-
if (PyUnicode_Check(arg))
834+
if (PyUnicode_Check(arg))
805835
*p = PyUnicode_AS_UNICODE(arg);
806836
else
807837
return "unicode";
@@ -850,7 +880,7 @@ convertsimple1(arg, p_format, p_va)
850880
if ((*pred)(arg))
851881
*p = arg;
852882
else
853-
return "(unspecified)";
883+
return "(unspecified)";
854884

855885
}
856886
else if (*format == '&') {
@@ -1161,7 +1191,7 @@ vgetargskeywords(args, keywords, format, kwlist, p_va)
11611191
}
11621192
if (!match) {
11631193
sprintf(msgbuf,
1164-
"%s is an invalid keyword argument for this function",
1194+
"%s is an invalid keyword argument for this function",
11651195
ks);
11661196
PyErr_SetString(PyExc_TypeError, msgbuf);
11671197
return 0;

0 commit comments

Comments
 (0)