Skip to content

Commit dddae66

Browse files
miss-islingtonbrianschubert
miss-islington
and
brianschubert
authored
[3.13] gh-124248: Fix crash in struct when processing 0p fields (GH-124251) (#124277)
gh-124248: Fix crash in struct when processing 0p fields (GH-124251) (cherry picked from commit 63f1960) Co-authored-by: Brian Schubert <brianm.schubert@gmail.com>
1 parent 7f101dc commit dddae66

4 files changed

Lines changed: 27 additions & 4 deletions

File tree

‎Lib/test/test_struct.py‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,13 @@ def test_new_features(self):
9696
('10s', b'helloworld', b'helloworld', b'helloworld', 0),
9797
('11s', b'helloworld', b'helloworld\0', b'helloworld\0', 1),
9898
('20s', b'helloworld', b'helloworld'+10*b'\0', b'helloworld'+10*b'\0', 1),
99+
('0p', b'helloworld', b'', b'', 1),
100+
('1p', b'helloworld', b'\x00', b'\x00', 1),
101+
('2p', b'helloworld', b'\x01h', b'\x01h', 1),
102+
('10p', b'helloworld', b'\x09helloworl', b'\x09helloworl', 1),
103+
('11p', b'helloworld', b'\x0Ahelloworld', b'\x0Ahelloworld', 0),
104+
('12p', b'helloworld', b'\x0Ahelloworld\0', b'\x0Ahelloworld\0', 1),
105+
('20p', b'helloworld', b'\x0Ahelloworld'+9*b'\0', b'\x0Ahelloworld'+9*b'\0', 1),
99106
('b', 7, b'\7', b'\7', 0),
100107
('b', -7, b'\371', b'\371', 0),
101108
('B', 7, b'\7', b'\7', 0),
@@ -339,6 +346,7 @@ def assertStructError(func, *args, **kwargs):
339346
def test_p_code(self):
340347
# Test p ("Pascal string") code.
341348
for code, input, expected, expectedback in [
349+
('0p', b'abc', b'', b''),
342350
('p', b'abc', b'\x00', b''),
343351
('1p', b'abc', b'\x00', b''),
344352
('2p', b'abc', b'\x01a', b'a'),
@@ -580,6 +588,7 @@ def test__sizeof__(self):
580588
self.check_sizeof('187s', 1)
581589
self.check_sizeof('20p', 1)
582590
self.check_sizeof('0s', 1)
591+
self.check_sizeof('0p', 1)
583592
self.check_sizeof('0c', 0)
584593

585594
def test_boundary_error_message(self):

‎Misc/ACKS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1652,6 +1652,7 @@ Scott Schram
16521652
Robin Schreiber
16531653
Chad J. Schroeder
16541654
Simon-Martin Schroeder
1655+
Brian Schubert
16551656
Christian Schubert
16561657
Sam Schulenburg
16571658
Andreas Schwab

‎Misc/NEWS.d/next/Library/2024-09-19-11-47-39.gh-issue-124248.g7rufd.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Fixed potential crash when using :mod:`struct` to process zero-width
2+
'Pascal string' fields (``0p``).

‎Modules/_struct.c‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1669,9 +1669,16 @@ s_unpack_internal(PyStructObject *soself, const char *startfrom,
16691669
if (e->format == 's') {
16701670
v = PyBytes_FromStringAndSize(res, code->size);
16711671
} else if (e->format == 'p') {
1672-
Py_ssize_t n = *(unsigned char*)res;
1673-
if (n >= code->size)
1674-
n = code->size - 1;
1672+
Py_ssize_t n;
1673+
if (code->size == 0) {
1674+
n = 0;
1675+
}
1676+
else {
1677+
n = *(unsigned char*)res;
1678+
if (n >= code->size) {
1679+
n = code->size - 1;
1680+
}
1681+
}
16751682
v = PyBytes_FromStringAndSize(res + 1, n);
16761683
} else {
16771684
v = e->unpack(state, res, e);
@@ -1982,8 +1989,12 @@ s_pack_internal(PyStructObject *soself, PyObject *const *args, int offset,
19821989
n = PyByteArray_GET_SIZE(v);
19831990
p = PyByteArray_AS_STRING(v);
19841991
}
1985-
if (n > (code->size - 1))
1992+
if (code->size == 0) {
1993+
n = 0;
1994+
}
1995+
else if (n > (code->size - 1)) {
19861996
n = code->size - 1;
1997+
}
19871998
if (n > 0)
19881999
memcpy(res + 1, p, n);
19892000
if (n > 255)

0 commit comments

Comments
 (0)