Lephenixnoir
/
PythonExtra
1
0
Fork 2
Code Issues 9 Pull Requests 3 Projects Releases 2 Wiki Activity

py/objstringio: Prevent offset wraparound for io.BytesIO objects. 

Too big positive, or too big negative offset values could lead to overflow
and address space wraparound and thus access to unrelated areas of memory
(a security issue).
This commit is contained in:
Tom Collins 2017-05-25 13:53:49 -07:00 committed by Paul Sokolovsky
parent 387a8d26f9
commit 168350cd98
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
py/objstringio.c
View File

@ -125,8 +125,19 @@ STATIC mp_uint_t stringio_ioctl(mp_obj_t o_in, mp_uint_t request, uintptr_t arg,
ref = o->vstr->len;
break;
}
o->pos = ref + s->offset;
s->offset = o->pos;
mp_uint_t new_pos = ref + s->offset;
if (s->offset < 0) {
if (new_pos > ref) {
// Negative offset from SEEK_CUR or SEEK_END went past 0.
// CPython sets position to 0, POSIX returns an EINVAL error
new_pos = 0;
}
} else if (new_pos < ref) {
// positive offset went beyond the limit of mp_uint_t
*errcode = MP_EINVAL; // replace with MP_EOVERFLOW when defined
return MP_STREAM_ERROR;
}
s->offset = o->pos = new_pos;
return 0;
}
case MP_STREAM_FLUSH: