5d6556dc39
memory allocation (CVE-2008-2315 and CVE-2008-2316) - also apply upstream svn rev.65262, fixes overflow checks in memory allocation (CVE-2008-3142 and CVE-2008-3144) Approved by: portmgr (pav) Security: http://www.vuxml.org/freebsd/0dccaa28-7f3c-11dd-8de5-0030843d3802.html
18 lines
614 B
C
18 lines
614 B
C
--- Objects/tupleobject.c.orig 2006-03-17 20:04:15.000000000 +0100
|
|
+++ Objects/tupleobject.c
|
|
@@ -60,11 +60,12 @@ PyTuple_New(register int size)
|
|
int nbytes = size * sizeof(PyObject *);
|
|
/* Check for overflow */
|
|
if (nbytes / sizeof(PyObject *) != (size_t)size ||
|
|
- (nbytes += sizeof(PyTupleObject) - sizeof(PyObject *))
|
|
- <= 0)
|
|
+ (nbytes > INT_MAX - sizeof(PyTupleObject) - sizeof(PyObject *)))
|
|
{
|
|
return PyErr_NoMemory();
|
|
}
|
|
+ nbytes += sizeof(PyTupleObject) - sizeof(PyObject *);
|
|
+
|
|
op = PyObject_GC_NewVar(PyTupleObject, &PyTuple_Type, size);
|
|
if (op == NULL)
|
|
return NULL;
|