Skip to content

Commit 1a1ff29

Browse files
serhiy-storchakaserhiy-storchaka
committed
Issue #23446: Use PyMem_New instead of PyMem_Malloc to avoid possible integer
overflows. Added few missed PyErr_NoMemory().
1 parent e1efc07 commit 1a1ff29

File tree

15 files changed

+50
-52
lines changed

15 files changed

+50
-52
lines changed

‎Modules/_ctypes/_ctypes.c‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4305,8 +4305,11 @@ Array_subscript(PyObject *myself, PyObject *item)
43054305
slicelen);
43064306
}
43074307

4308-
dest = (wchar_t *)PyMem_Malloc(
4309-
slicelen * sizeof(wchar_t));
4308+
dest = PyMem_New(wchar_t, slicelen);
4309+
if (dest == NULL) {
4310+
PyErr_NoMemory();
4311+
return NULL;
4312+
}
43104313

43114314
for (cur = start, i = 0; i < slicelen;
43124315
cur += step, i++) {
@@ -4986,7 +4989,7 @@ Pointer_subscript(PyObject *myself, PyObject *item)
49864989
return PyUnicode_FromWideChar(ptr + start,
49874990
len);
49884991
}
4989-
dest = (wchar_t *)PyMem_Malloc(len * sizeof(wchar_t));
4992+
dest = PyMem_New(wchar_t, len);
49904993
if (dest == NULL)
49914994
return PyErr_NoMemory();
49924995
for (cur = start, i = 0; i < len; cur += step, i++) {

‎Modules/_ctypes/stgdict.c‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,14 +76,18 @@ PyCStgDict_clone(StgDictObject *dst, StgDictObject *src)
7676

7777
if (src->format) {
7878
dst->format = PyMem_Malloc(strlen(src->format) + 1);
79-
if (dst->format == NULL)
79+
if (dst->format == NULL) {
80+
PyErr_NoMemory();
8081
return -1;
82+
}
8183
strcpy(dst->format, src->format);
8284
}
8385
if (src->shape) {
8486
dst->shape = PyMem_Malloc(sizeof(Py_ssize_t) * src->ndim);
85-
if (dst->shape == NULL)
87+
if (dst->shape == NULL) {
88+
PyErr_NoMemory();
8689
return -1;
90+
}
8791
memcpy(dst->shape, src->shape,
8892
sizeof(Py_ssize_t) * src->ndim);
8993
}
@@ -380,7 +384,7 @@ PyCStructUnionType_update_stgdict(PyObject *type, PyObject *fields, int isStruct
380384
union_size = 0;
381385
total_align = align ? align : 1;
382386
stgdict->ffi_type_pointer.type = FFI_TYPE_STRUCT;
383-
stgdict->ffi_type_pointer.elements = PyMem_Malloc(sizeof(ffi_type *) * (basedict->length + len + 1));
387+
stgdict->ffi_type_pointer.elements = PyMem_New(ffi_type *, basedict->length + len + 1);
384388
if (stgdict->ffi_type_pointer.elements == NULL) {
385389
PyErr_NoMemory();
386390
return -1;
@@ -398,7 +402,7 @@ PyCStructUnionType_update_stgdict(PyObject *type, PyObject *fields, int isStruct
398402
union_size = 0;
399403
total_align = 1;
400404
stgdict->ffi_type_pointer.type = FFI_TYPE_STRUCT;
401-
stgdict->ffi_type_pointer.elements = PyMem_Malloc(sizeof(ffi_type *) * (len + 1));
405+
stgdict->ffi_type_pointer.elements = PyMem_New(ffi_type *, len + 1);
402406
if (stgdict->ffi_type_pointer.elements == NULL) {
403407
PyErr_NoMemory();
404408
return -1;

‎Modules/_localemodule.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ PyLocale_strxfrm(PyObject* self, PyObject* args)
254254

255255
/* assume no change in size, first */
256256
n1 = n1 + 1;
257-
buf = PyMem_Malloc(n1 * sizeof(wchar_t));
257+
buf = PyMem_New(wchar_t, n1);
258258
if (!buf) {
259259
PyErr_NoMemory();
260260
goto exit;

‎Modules/_ssl.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3838,10 +3838,11 @@ static int _setup_ssl_threads(void) {
38383838

38393839
if (_ssl_locks == NULL) {
38403840
_ssl_locks_count = CRYPTO_num_locks();
3841-
_ssl_locks = (PyThread_type_lock *)
3842-
PyMem_Malloc(sizeof(PyThread_type_lock) * _ssl_locks_count);
3843-
if (_ssl_locks == NULL)
3841+
_ssl_locks = PyMem_New(PyThread_type_lock, _ssl_locks_count);
3842+
if (_ssl_locks == NULL) {
3843+
PyErr_NoMemory();
38443844
return 0;
3845+
}
38453846
memset(_ssl_locks, 0,
38463847
sizeof(PyThread_type_lock) * _ssl_locks_count);
38473848
for (i = 0; i < _ssl_locks_count; i++) {

‎Modules/_testbuffer.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -850,7 +850,7 @@ seq_as_ssize_array(PyObject *seq, Py_ssize_t len, int is_shape)
850850
Py_ssize_t *dest;
851851
Py_ssize_t x, i;
852852

853-
dest = PyMem_Malloc(len * (sizeof *dest));
853+
dest = PyMem_New(Py_ssize_t, len);
854854
if (dest == NULL) {
855855
PyErr_NoMemory();
856856
return NULL;

‎Modules/_testcapimodule.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1516,7 +1516,7 @@ unicode_aswidechar(PyObject *self, PyObject *args)
15161516

15171517
if (!PyArg_ParseTuple(args, "Un", &unicode, &buflen))
15181518
return NULL;
1519-
buffer = PyMem_Malloc(buflen * sizeof(wchar_t));
1519+
buffer = PyMem_New(wchar_t, buflen);
15201520
if (buffer == NULL)
15211521
return PyErr_NoMemory();
15221522

‎Modules/getpath.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -735,7 +735,7 @@ calculate_path(void)
735735
bufsz += wcslen(zip_path) + 1;
736736
bufsz += wcslen(exec_prefix) + 1;
737737

738-
buf = (wchar_t *)PyMem_Malloc(bufsz * sizeof(wchar_t));
738+
buf = PyMem_New(wchar_t, bufsz);
739739
if (buf == NULL) {
740740
Py_FatalError(
741741
"Not enough memory for dynamic PYTHONPATH");

‎Modules/posixmodule.c‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1638,7 +1638,7 @@ get_target_path(HANDLE hdl, wchar_t **target_path)
16381638
if(!buf_size)
16391639
return FALSE;
16401640

1641-
buf = (wchar_t *)PyMem_Malloc((buf_size+1)*sizeof(wchar_t));
1641+
buf = PyMem_New(wchar_t, buf_size+1);
16421642
if (!buf) {
16431643
SetLastError(ERROR_OUTOFMEMORY);
16441644
return FALSE;
@@ -3627,7 +3627,7 @@ _listdir_windows_no_opendir(path_t *path, PyObject *list)
36273627
len = wcslen(path->wide);
36283628
}
36293629
/* The +5 is so we can append "\\*.*\0" */
3630-
wnamebuf = PyMem_Malloc((len + 5) * sizeof(wchar_t));
3630+
wnamebuf = PyMem_New(wchar_t, len + 5);
36313631
if (!wnamebuf) {
36323632
PyErr_NoMemory();
36333633
goto exit;
@@ -3917,7 +3917,7 @@ posix__getfullpathname(PyObject *self, PyObject *args)
39173917
Py_ARRAY_LENGTH(woutbuf),
39183918
woutbuf, &wtemp);
39193919
if (result > Py_ARRAY_LENGTH(woutbuf)) {
3920-
woutbufp = PyMem_Malloc(result * sizeof(wchar_t));
3920+
woutbufp = PyMem_New(wchar_t, result);
39213921
if (!woutbufp)
39223922
return PyErr_NoMemory();
39233923
result = GetFullPathNameW(wpath, result, woutbufp, &wtemp);
@@ -3997,7 +3997,7 @@ posix__getfinalpathname(PyObject *self, PyObject *args)
39973997
if(!buf_size)
39983998
return win32_error_object("GetFinalPathNameByHandle", po);
39993999

4000-
target_path = (wchar_t *)PyMem_Malloc((buf_size+1)*sizeof(wchar_t));
4000+
target_path = PyMem_New(wchar_t, buf_size+1);
40014001
if(!target_path)
40024002
return PyErr_NoMemory();
40034003

@@ -4082,7 +4082,7 @@ posix__getvolumepathname(PyObject *self, PyObject *args)
40824082
return NULL;
40834083
}
40844084

4085-
mountpath = (wchar_t *)PyMem_Malloc(buflen * sizeof(wchar_t));
4085+
mountpath = PyMem_New(wchar_t, buflen);
40864086
if (mountpath == NULL)
40874087
return PyErr_NoMemory();
40884088

@@ -6213,9 +6213,9 @@ posix_getgrouplist(PyObject *self, PyObject *args)
62136213
#endif
62146214

62156215
#ifdef __APPLE__
6216-
groups = PyMem_Malloc(ngroups * sizeof(int));
6216+
groups = PyMem_New(int, ngroups);
62176217
#else
6218-
groups = PyMem_Malloc(ngroups * sizeof(gid_t));
6218+
groups = PyMem_New(gid_t, ngroups);
62196219
#endif
62206220
if (groups == NULL)
62216221
return PyErr_NoMemory();
@@ -6293,7 +6293,7 @@ posix_getgroups(PyObject *self, PyObject *noargs)
62936293
/* groups will fit in existing array */
62946294
alt_grouplist = grouplist;
62956295
} else {
6296-
alt_grouplist = PyMem_Malloc(n * sizeof(gid_t));
6296+
alt_grouplist = PyMem_New(gid_t, n);
62976297
if (alt_grouplist == NULL) {
62986298
errno = EINVAL;
62996299
return posix_error();
@@ -6319,7 +6319,7 @@ posix_getgroups(PyObject *self, PyObject *noargs)
63196319
/* Avoid malloc(0) */
63206320
alt_grouplist = grouplist;
63216321
} else {
6322-
alt_grouplist = PyMem_Malloc(n * sizeof(gid_t));
6322+
alt_grouplist = PyMem_New(gid_t, n);
63236323
if (alt_grouplist == NULL) {
63246324
errno = EINVAL;
63256325
return posix_error();

‎Modules/pyexpat.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -928,7 +928,7 @@ xmlparse_ExternalEntityParserCreate(xmlparseobject *self, PyObject *args)
928928
for (i = 0; handler_info[i].name != NULL; i++)
929929
/* do nothing */;
930930

931-
new_parser->handlers = PyMem_Malloc(sizeof(PyObject *) * i);
931+
new_parser->handlers = PyMem_New(PyObject *, i);
932932
if (!new_parser->handlers) {
933933
Py_DECREF(new_parser);
934934
return PyErr_NoMemory();
@@ -1121,7 +1121,7 @@ newxmlparseobject(char *encoding, char *namespace_separator, PyObject *intern)
11211121
for (i = 0; handler_info[i].name != NULL; i++)
11221122
/* do nothing */;
11231123

1124-
self->handlers = PyMem_Malloc(sizeof(PyObject *) * i);
1124+
self->handlers = PyMem_New(PyObject *, i);
11251125
if (!self->handlers) {
11261126
Py_DECREF(self);
11271127
return PyErr_NoMemory();

‎Modules/socketmodule.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4126,9 +4126,11 @@ socket_gethostname(PyObject *self, PyObject *unused)
41264126

41274127
/* MSDN says ERROR_MORE_DATA may occur because DNS allows longer
41284128
names */
4129-
name = PyMem_Malloc(size * sizeof(wchar_t));
4130-
if (!name)
4129+
name = PyMem_New(wchar_t, size);
4130+
if (!name) {
4131+
PyErr_NoMemory();
41314132
return NULL;
4133+
}
41324134
if (!GetComputerNameExW(ComputerNamePhysicalDnsHostname,
41334135
name,
41344136
&size))

0 commit comments

Comments
 (0)