changeset:   102638:10b89df93c58
branch:      3.4
parent:      102545:190ebf99bf45
parent:      102637:afa356402217
user:        Benjamin Peterson <benjamin@python.org>
date:        Sat Aug 13 17:21:22 2016 -0700
files:       Misc/NEWS Modules/_csv.c
description:
merge 3.3 (#27758)


diff -r 190ebf99bf45 -r 10b89df93c58 Misc/NEWS
--- a/Misc/NEWS	Fri Aug 05 21:43:25 2016 +0100
+++ b/Misc/NEWS	Sat Aug 13 17:21:22 2016 -0700
@@ -13,6 +13,9 @@
 Library
 -------
 
+- Issue #27758: Fix possible integer overflow in the _csv module for large record
+  lengths.
+
 - Issue #27568: Prevent HTTPoxy attack (CVE-2016-1000110). Ignore the
   HTTP_PROXY variable when REQUEST_METHOD environment is set, which indicates
   that the script is in CGI mode.
diff -r 190ebf99bf45 -r 10b89df93c58 Modules/_csv.c
--- a/Modules/_csv.c	Fri Aug 05 21:43:25 2016 +0100
+++ b/Modules/_csv.c	Sat Aug 13 17:21:22 2016 -0700
@@ -1016,11 +1016,19 @@
     int i;
     Py_ssize_t rec_len;
 
-#define ADDCH(c) \
+#define INCLEN \
+    do {\
+        if (!copy_phase && rec_len == PY_SSIZE_T_MAX) {    \
+            goto overflow; \
+        } \
+        rec_len++; \
+    } while(0)
+
+#define ADDCH(c)                                \
     do {\
         if (copy_phase) \
             self->rec[rec_len] = c;\
-        rec_len++;\
+        INCLEN;\
     } while(0)
 
     rec_len = self->rec_len;
@@ -1086,11 +1094,18 @@
     if (*quoted) {
         if (copy_phase)
             ADDCH(dialect->quotechar);
-        else
-            rec_len += 2;
+        else {
+            INCLEN; /* starting quote */
+            INCLEN; /* ending quote */
+        }
     }
     return rec_len;
+
+  overflow:
+    PyErr_NoMemory();
+    return -1;
 #undef ADDCH
+#undef INCLEN
 }
 
 static int