Skip to content

Commit 4d0d982

Browse files
serhiy-storchakaserhiy-storchaka
committed
Issue #23446: Use PyMem_New instead of PyMem_Malloc to avoid possible integer
overflows. Added few missed PyErr_NoMemory().
2 parents 53fa8b2 + 1a1ff29 commit 4d0d982

File tree

15 files changed

+50
-52
lines changed

15 files changed

+50
-52
lines changed

‎Modules/_ctypes/_ctypes.c‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4305,8 +4305,11 @@ Array_subscript(PyObject *myself, PyObject *item)
43054305
slicelen);
43064306
}
43074307

4308-
dest = (wchar_t *)PyMem_Malloc(
4309-
slicelen * sizeof(wchar_t));
4308+
dest = PyMem_New(wchar_t, slicelen);
4309+
if (dest == NULL) {
4310+
PyErr_NoMemory();
4311+
return NULL;
4312+
}
43104313

43114314
for (cur = start, i = 0; i < slicelen;
43124315
cur += step, i++) {
@@ -4986,7 +4989,7 @@ Pointer_subscript(PyObject *myself, PyObject *item)
49864989
return PyUnicode_FromWideChar(ptr + start,
49874990
len);
49884991
}
4989-
dest = (wchar_t *)PyMem_Malloc(len * sizeof(wchar_t));
4992+
dest = PyMem_New(wchar_t, len);
49904993
if (dest == NULL)
49914994
return PyErr_NoMemory();
49924995
for (cur = start, i = 0; i < len; cur += step, i++) {

‎Modules/_ctypes/stgdict.c‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,14 +76,18 @@ PyCStgDict_clone(StgDictObject *dst, StgDictObject *src)
7676

7777
if (src->format) {
7878
dst->format = PyMem_Malloc(strlen(src->format) + 1);
79-
if (dst->format == NULL)
79+
if (dst->format == NULL) {
80+
PyErr_NoMemory();
8081
return -1;
82+
}
8183
strcpy(dst->format, src->format);
8284
}
8385
if (src->shape) {
8486
dst->shape = PyMem_Malloc(sizeof(Py_ssize_t) * src->ndim);
85-
if (dst->shape == NULL)
87+
if (dst->shape == NULL) {
88+
PyErr_NoMemory();
8689
return -1;
90+
}
8791
memcpy(dst->shape, src->shape,
8892
sizeof(Py_ssize_t) * src->ndim);
8993
}
@@ -380,7 +384,7 @@ PyCStructUnionType_update_stgdict(PyObject *type, PyObject *fields, int isStruct
380384
union_size = 0;
381385
total_align = align ? align : 1;
382386
stgdict->ffi_type_pointer.type = FFI_TYPE_STRUCT;
383-
stgdict->ffi_type_pointer.elements = PyMem_Malloc(sizeof(ffi_type *) * (basedict->length + len + 1));
387+
stgdict->ffi_type_pointer.elements = PyMem_New(ffi_type *, basedict->length + len + 1);
384388
if (stgdict->ffi_type_pointer.elements == NULL) {
385389
PyErr_NoMemory();
386390
return -1;
@@ -398,7 +402,7 @@ PyCStructUnionType_update_stgdict(PyObject *type, PyObject *fields, int isStruct
398402
union_size = 0;
399403
total_align = 1;
400404
stgdict->ffi_type_pointer.type = FFI_TYPE_STRUCT;
401-
stgdict->ffi_type_pointer.elements = PyMem_Malloc(sizeof(ffi_type *) * (len + 1));
405+
stgdict->ffi_type_pointer.elements = PyMem_New(ffi_type *, len + 1);
402406
if (stgdict->ffi_type_pointer.elements == NULL) {
403407
PyErr_NoMemory();
404408
return -1;

‎Modules/_localemodule.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ PyLocale_strxfrm(PyObject* self, PyObject* args)
254254

255255
/* assume no change in size, first */
256256
n1 = n1 + 1;
257-
buf = PyMem_Malloc(n1 * sizeof(wchar_t));
257+
buf = PyMem_New(wchar_t, n1);
258258
if (!buf) {
259259
PyErr_NoMemory();
260260
goto exit;

‎Modules/_ssl.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4287,10 +4287,11 @@ static int _setup_ssl_threads(void) {
42874287

42884288
if (_ssl_locks == NULL) {
42894289
_ssl_locks_count = CRYPTO_num_locks();
4290-
_ssl_locks = (PyThread_type_lock *)
4291-
PyMem_Malloc(sizeof(PyThread_type_lock) * _ssl_locks_count);
4292-
if (_ssl_locks == NULL)
4290+
_ssl_locks = PyMem_New(PyThread_type_lock, _ssl_locks_count);
4291+
if (_ssl_locks == NULL) {
4292+
PyErr_NoMemory();
42934293
return 0;
4294+
}
42944295
memset(_ssl_locks, 0,
42954296
sizeof(PyThread_type_lock) * _ssl_locks_count);
42964297
for (i = 0; i < _ssl_locks_count; i++) {

‎Modules/_testbuffer.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -850,7 +850,7 @@ seq_as_ssize_array(PyObject *seq, Py_ssize_t len, int is_shape)
850850
Py_ssize_t *dest;
851851
Py_ssize_t x, i;
852852

853-
dest = PyMem_Malloc(len * (sizeof *dest));
853+
dest = PyMem_New(Py_ssize_t, len);
854854
if (dest == NULL) {
855855
PyErr_NoMemory();
856856
return NULL;

‎Modules/_testcapimodule.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1517,7 +1517,7 @@ unicode_aswidechar(PyObject *self, PyObject *args)
15171517

15181518
if (!PyArg_ParseTuple(args, "Un", &unicode, &buflen))
15191519
return NULL;
1520-
buffer = PyMem_Malloc(buflen * sizeof(wchar_t));
1520+
buffer = PyMem_New(wchar_t, buflen);
15211521
if (buffer == NULL)
15221522
return PyErr_NoMemory();
15231523

‎Modules/getpath.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -735,7 +735,7 @@ calculate_path(void)
735735
bufsz += wcslen(zip_path) + 1;
736736
bufsz += wcslen(exec_prefix) + 1;
737737

738-
buf = (wchar_t *)PyMem_Malloc(bufsz * sizeof(wchar_t));
738+
buf = PyMem_New(wchar_t, bufsz);
739739
if (buf == NULL) {
740740
Py_FatalError(
741741
"Not enough memory for dynamic PYTHONPATH");

‎Modules/posixmodule.c‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1620,7 +1620,7 @@ get_target_path(HANDLE hdl, wchar_t **target_path)
16201620
if(!buf_size)
16211621
return FALSE;
16221622

1623-
buf = (wchar_t *)PyMem_Malloc((buf_size+1)*sizeof(wchar_t));
1623+
buf = PyMem_New(wchar_t, buf_size+1);
16241624
if (!buf) {
16251625
SetLastError(ERROR_OUTOFMEMORY);
16261626
return FALSE;
@@ -4472,7 +4472,7 @@ _listdir_windows_no_opendir(path_t *path, PyObject *list)
44724472
len = wcslen(path->wide);
44734473
}
44744474
/* The +5 is so we can append "\\*.*\0" */
4475-
wnamebuf = PyMem_Malloc((len + 5) * sizeof(wchar_t));
4475+
wnamebuf = PyMem_New(wchar_t, len + 5);
44764476
if (!wnamebuf) {
44774477
PyErr_NoMemory();
44784478
goto exit;
@@ -4809,7 +4809,7 @@ posix__getfullpathname(PyObject *self, PyObject *args)
48094809
Py_ARRAY_LENGTH(woutbuf),
48104810
woutbuf, &wtemp);
48114811
if (result > Py_ARRAY_LENGTH(woutbuf)) {
4812-
woutbufp = PyMem_Malloc(result * sizeof(wchar_t));
4812+
woutbufp = PyMem_New(wchar_t, result);
48134813
if (!woutbufp)
48144814
return PyErr_NoMemory();
48154815
result = GetFullPathNameW(wpath, result, woutbufp, &wtemp);
@@ -4923,7 +4923,7 @@ os__getfinalpathname_impl(PyModuleDef *module, PyObject *path)
49234923
if(!buf_size)
49244924
return win32_error_object("GetFinalPathNameByHandle", path);
49254925

4926-
target_path = (wchar_t *)PyMem_Malloc((buf_size+1)*sizeof(wchar_t));
4926+
target_path = PyMem_New(wchar_t, buf_size+1);
49274927
if(!target_path)
49284928
return PyErr_NoMemory();
49294929

@@ -5041,7 +5041,7 @@ os__getvolumepathname_impl(PyModuleDef *module, PyObject *path)
50415041
return NULL;
50425042
}
50435043

5044-
mountpath = (wchar_t *)PyMem_Malloc(buflen * sizeof(wchar_t));
5044+
mountpath = PyMem_New(wchar_t, buflen);
50455045
if (mountpath == NULL)
50465046
return PyErr_NoMemory();
50475047

@@ -8421,9 +8421,9 @@ posix_getgrouplist(PyObject *self, PyObject *args)
84218421
#endif
84228422

84238423
#ifdef __APPLE__
8424-
groups = PyMem_Malloc(ngroups * sizeof(int));
8424+
groups = PyMem_New(int, ngroups);
84258425
#else
8426-
groups = PyMem_Malloc(ngroups * sizeof(gid_t));
8426+
groups = PyMem_New(gid_t, ngroups);
84278427
#endif
84288428
if (groups == NULL)
84298429
return PyErr_NoMemory();
@@ -8523,7 +8523,7 @@ os_getgroups_impl(PyModuleDef *module)
85238523
/* groups will fit in existing array */
85248524
alt_grouplist = grouplist;
85258525
} else {
8526-
alt_grouplist = PyMem_Malloc(n * sizeof(gid_t));
8526+
alt_grouplist = PyMem_New(gid_t, n);
85278527
if (alt_grouplist == NULL) {
85288528
errno = EINVAL;
85298529
return posix_error();
@@ -8549,7 +8549,7 @@ os_getgroups_impl(PyModuleDef *module)
85498549
/* Avoid malloc(0) */
85508550
alt_grouplist = grouplist;
85518551
} else {
8552-
alt_grouplist = PyMem_Malloc(n * sizeof(gid_t));
8552+
alt_grouplist = PyMem_New(gid_t, n);
85538553
if (alt_grouplist == NULL) {
85548554
errno = EINVAL;
85558555
return posix_error();

‎Modules/pyexpat.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1093,7 +1093,7 @@ pyexpat_xmlparser_ExternalEntityParserCreate_impl(xmlparseobject *self, const ch
10931093
for (i = 0; handler_info[i].name != NULL; i++)
10941094
/* do nothing */;
10951095

1096-
new_parser->handlers = PyMem_Malloc(sizeof(PyObject *) * i);
1096+
new_parser->handlers = PyMem_New(PyObject *, i);
10971097
if (!new_parser->handlers) {
10981098
Py_DECREF(new_parser);
10991099
return PyErr_NoMemory();
@@ -1416,7 +1416,7 @@ newxmlparseobject(const char *encoding, const char *namespace_separator, PyObjec
14161416
for (i = 0; handler_info[i].name != NULL; i++)
14171417
/* do nothing */;
14181418

1419-
self->handlers = PyMem_Malloc(sizeof(PyObject *) * i);
1419+
self->handlers = PyMem_New(PyObject *, i);
14201420
if (!self->handlers) {
14211421
Py_DECREF(self);
14221422
return PyErr_NoMemory();

‎Modules/socketmodule.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4213,9 +4213,11 @@ socket_gethostname(PyObject *self, PyObject *unused)
42134213

42144214
/* MSDN says ERROR_MORE_DATA may occur because DNS allows longer
42154215
names */
4216-
name = PyMem_Malloc(size * sizeof(wchar_t));
4217-
if (!name)
4216+
name = PyMem_New(wchar_t, size);
4217+
if (!name) {
4218+
PyErr_NoMemory();
42184219
return NULL;
4220+
}
42194221
if (!GetComputerNameExW(ComputerNamePhysicalDnsHostname,
42204222
name,
42214223
&size))

0 commit comments

Comments
 (0)