Ensure negative offsets cannot be passed to buffer(). When composing

nascheme · nascheme · commit ff711ad8b07c · 2004-09-24T19:17:26.000Z
buffers, compute the new buffer size based on the old buffer size. Fixes SF bug #1034242. git-svn-id: http://svn.python.org/projects/python/trunk@37424 6015fed2-1504-0410-9fe1-9d1591cc4771
diff --git a/Objects/bufferobject.c b/Objects/bufferobject.c
@@ -90,10 +90,23 @@ buffer_from_memory(PyObject *base, int size, int offset, void *ptr,
 static PyObject *
 buffer_from_object(PyObject *base, int size, int offset, int readonly)
 {
+	if (offset < 0) {
+		PyErr_SetString(PyExc_ValueError,
+				"offset must be zero or positive");
+		return NULL;
+	}
 	if ( PyBuffer_Check(base) && (((PyBufferObject *)base)->b_base) ) {
 		/* another buffer, refer to the base object */
-		offset += ((PyBufferObject *)base)->b_offset;
-		base = ((PyBufferObject *)base)->b_base;
+		PyBufferObject *b = (PyBufferObject *)base;
+		if (b->b_size != Py_END_OF_BUFFER) {
+			int base_size = b->b_size - offset;
+			if (base_size < 0)
+				base_size = 0;
+			if (size == Py_END_OF_BUFFER || size > base_size)
+				size = base_size;
+		}
+		offset += b->b_offset;
+		base = b->b_base;
 	}
 	return buffer_from_memory(base, size, offset, NULL, readonly);
 }
