# HG changeset patch
# User guido.van.rossum
# Date 1205270094 -3600
# Branch release25-maint
# Node ID a56281dabecc662d2b5358c5964845e98f30c745
# Parent 6420de2f7fd2630dbea701120b67e8757960ecf8
[svn r61349] Fix the overflows in expandtabs(). "This time for sure!"
(Exploit at request.)
diff -r 6420de2f7fd2 -r a56281dabecc Objects/stringobject.c
--- a/Objects/stringobject.c Fri Mar 07 22:10:06 2008 +0100
+++ b/Objects/stringobject.c Tue Mar 11 22:14:54 2008 +0100
@@ -3299,9 +3299,9 @@ If tabsize is not given, a tab size of 8
static PyObject*
string_expandtabs(PyStringObject *self, PyObject *args)
{
- const char *e, *p;
+ const char *e, *p, *qe;
char *q;
- Py_ssize_t i, j, old_j;
+ Py_ssize_t i, j, incr;
PyObject *u;
int tabsize = 8;
@@ -3309,63 +3309,70 @@ string_expandtabs(PyStringObject *self,
return NULL;
/* First pass: determine size of output string */
- i = j = old_j = 0;
- e = PyString_AS_STRING(self) + PyString_GET_SIZE(self);
+ i = 0; /* chars up to and including most recent \n or \r */
+ j = 0; /* chars since most recent \n or \r (use in tab calculations) */
+ e = PyString_AS_STRING(self) + PyString_GET_SIZE(self); /* end of input */
for (p = PyString_AS_STRING(self); p < e; p++)
if (*p == '\t') {
if (tabsize > 0) {
- j += tabsize - (j % tabsize);
- if (old_j > j) {
- PyErr_SetString(PyExc_OverflowError,
- "new string is too long");
- return NULL;
- }
- old_j = j;
+ incr = tabsize - (j % tabsize);
+ if (j > PY_SSIZE_T_MAX - incr)
+ goto overflow1;
+ j += incr;
}
}
else {
+ if (j > PY_SSIZE_T_MAX - 1)
+ goto overflow1;
j++;
if (*p == '\n' || *p == '\r') {
+ if (i > PY_SSIZE_T_MAX - j)
+ goto overflow1;
i += j;
- old_j = j = 0;
- if (i < 0) {
- PyErr_SetString(PyExc_OverflowError,
- "new string is too long");
- return NULL;
- }
+ j = 0;
}
}
- if ((i + j) < 0) {
- PyErr_SetString(PyExc_OverflowError, "new string is too long");
- return NULL;
- }
+ if (i > PY_SSIZE_T_MAX - j)
+ goto overflow1;
/* Second pass: create output string and fill it */
u = PyString_FromStringAndSize(NULL, i + j);
if (!u)
return NULL;
- j = 0;
- q = PyString_AS_STRING(u);
+ j = 0; /* same as in first pass */
+ q = PyString_AS_STRING(u); /* next output char */
+ qe = PyString_AS_STRING(u) + PyString_GET_SIZE(u); /* end of output */
for (p = PyString_AS_STRING(self); p < e; p++)
if (*p == '\t') {
if (tabsize > 0) {
i = tabsize - (j % tabsize);
j += i;
- while (i--)
+ while (i--) {
+ if (q >= qe)
+ goto overflow2;
*q++ = ' ';
+ }
}
}
else {
+ if (q >= qe)
+ goto overflow2;
+ *q++ = *p;
j++;
- *q++ = *p;
if (*p == '\n' || *p == '\r')
j = 0;
}
return u;
+
+ overflow2:
+ Py_DECREF(u);
+ overflow1:
+ PyErr_SetString(PyExc_OverflowError, "new string is too long");
+ return NULL;
}
Py_LOCAL_INLINE(PyObject *)
diff -r 6420de2f7fd2 -r a56281dabecc Objects/unicodeobject.c
--- a/Objects/unicodeobject.c Fri Mar 07 22:10:06 2008 +0100
+++ b/Objects/unicodeobject.c Tue Mar 11 22:14:54 2008 +0100
@@ -5689,7 +5689,8 @@ unicode_expandtabs(PyUnicodeObject *self
Py_UNICODE *e;
Py_UNICODE *p;
Py_UNICODE *q;
- Py_ssize_t i, j, old_j;
+ Py_UNICODE *qe;
+ Py_ssize_t i, j, incr;
PyUnicodeObject *u;
int tabsize = 8;
@@ -5697,63 +5698,70 @@ unicode_expandtabs(PyUnicodeObject *self
return NULL;
/* First pass: determine size of output string */
- i = j = old_j = 0;
- e = self->str + self->length;
+ i = 0; /* chars up to and including most recent \n or \r */
+ j = 0; /* chars since most recent \n or \r (use in tab calculations) */
+ e = self->str + self->length; /* end of input */
for (p = self->str; p < e; p++)
if (*p == '\t') {
if (tabsize > 0) {
- j += tabsize - (j % tabsize);
- if (old_j > j) {
- PyErr_SetString(PyExc_OverflowError,
- "new string is too long");
- return NULL;
- }
- old_j = j;
- }
+ incr = tabsize - (j % tabsize); /* cannot overflow */
+ if (j > PY_SSIZE_T_MAX - incr)
+ goto overflow1;
+ j += incr;
+ }
}
else {
+ if (j > PY_SSIZE_T_MAX - 1)
+ goto overflow1;
j++;
if (*p == '\n' || *p == '\r') {
+ if (i > PY_SSIZE_T_MAX - j)
+ goto overflow1;
i += j;
- old_j = j = 0;
- if (i < 0) {
- PyErr_SetString(PyExc_OverflowError,
- "new string is too long");
- return NULL;
- }
- }
- }
-
- if ((i + j) < 0) {
- PyErr_SetString(PyExc_OverflowError, "new string is too long");
- return NULL;
- }
+ j = 0;
+ }
+ }
+
+ if (i > PY_SSIZE_T_MAX - j)
+ goto overflow1;
/* Second pass: create output string and fill it */
u = _PyUnicode_New(i + j);
if (!u)
return NULL;
- j = 0;
- q = u->str;
+ j = 0; /* same as in first pass */
+ q = u->str; /* next output char */
+ qe = u->str + u->length; /* end of output */
for (p = self->str; p < e; p++)
if (*p == '\t') {
if (tabsize > 0) {
i = tabsize - (j % tabsize);
j += i;
- while (i--)
+ while (i--) {
+ if (q >= qe)
+ goto overflow2;
*q++ = ' ';
+ }
}
}
else {
+ if (q >= qe)
+ goto overflow2;
+ *q++ = *p;
j++;
- *q++ = *p;
if (*p == '\n' || *p == '\r')
j = 0;
}
return (PyObject*) u;
+
+ overflow2:
+ Py_DECREF(u);
+ overflow1:
+ PyErr_SetString(PyExc_OverflowError, "new string is too long");
+ return NULL;
}
PyDoc_STRVAR(find__doc__,
