Issue #18427: str.replace could crash the interpreter with huge strings.

ronaldoussoren · ronaldoussoren · commit 3687e8055cf7 · 2013-07-11T13:33:55.000+02:00
This fixes two places where 'int' was used to represent the size of strings, instead of 'Py_ssize_t'. (The issue is not present in the corresponding code in the 3.x branches) Fixes #18427
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -24,6 +24,8 @@ Core and Builtins
 Library
 -------
 
+- Issue #18427: str.replace could crash the interpreter with huge strings.
+
 - Issue #18347: ElementTree's html serializer now preserves the case of
   closing tags.
 
@@ -88,7 +90,7 @@ IDLE
 
 - Issue #7136: In the Idle File menu, "New Window" is renamed "New File".
   Patch by Tal Einat, Roget Serwy, and Todd Rovito.
-  
+
 - Issue #8515: Set __file__ when run file in IDLE.
   Initial patch by Bruce Frederiksen.
 
diff --git a/Objects/stringobject.c b/Objects/stringobject.c
@@ -882,9 +882,9 @@ string_print(PyStringObject *op, FILE *fp, int flags)
             size -= chunk_size;
         }
 #ifdef __VMS
-        if (size) fwrite(data, (int)size, 1, fp);
+        if (size) fwrite(data, (size_t)size, 1, fp);
 #else
-        fwrite(data, 1, (int)size, fp);
+        fwrite(data, 1, (size_t)size, fp);
 #endif
         Py_END_ALLOW_THREADS
         return 0;
@@ -2332,7 +2332,7 @@ return_self(PyStringObject *self)
 }
 
 Py_LOCAL_INLINE(Py_ssize_t)
-countchar(const char *target, int target_len, char c, Py_ssize_t maxcount)
+countchar(const char *target, Py_ssize_t target_len, char c, Py_ssize_t maxcount)
 {
     Py_ssize_t count=0;
     const char *start=target;

Original file line number	Diff line number	Diff line change
`@@ -882,9 +882,9 @@ string_print(PyStringObject op, FILE fp, int flags)`
`882`	`882`	`size -= chunk_size;`
`883`	`883`	`}`
`884`	`884`	`#ifdef __VMS`
`885`		`- if (size) fwrite(data, (int)size, 1, fp);`
	`885`	`+ if (size) fwrite(data, (size_t)size, 1, fp);`
`886`	`886`	`#else`
`887`		`- fwrite(data, 1, (int)size, fp);`
	`887`	`+ fwrite(data, 1, (size_t)size, fp);`
`888`	`888`	`#endif`
`889`	`889`	`Py_END_ALLOW_THREADS`
`890`	`890`	`return 0;`
`@@ -2332,7 +2332,7 @@ return_self(PyStringObject *self)`
`2332`	`2332`	`}`
`2333`	`2333`
`2334`	`2334`	`Py_LOCAL_INLINE(Py_ssize_t)`
`2335`		`-countchar(const char *target, int target_len, char c, Py_ssize_t maxcount)`
	`2335`	`+countchar(const char *target, Py_ssize_t target_len, char c, Py_ssize_t maxcount)`
`2336`	`2336`	`{`
`2337`	`2337`	`Py_ssize_t count=0;`
`2338`	`2338`	`const char *start=target;`