changeset:   102397:6e166b66aa44
branch:      2.7
parent:      102351:345ec7455b75
user:        Martin Panter <vadmium+py@gmail.com>
date:        Mon Jul 18 07:53:13 2016 +0000
files:       Misc/NEWS Objects/bytearrayobject.c
description:
Issue #27507: Check for integer overflow in bytearray.extend()

Patch by Xiang Zhang.


diff -r 345ec7455b75 -r 6e166b66aa44 Misc/NEWS
--- a/Misc/NEWS	Thu Jul 14 22:00:03 2016 -0700
+++ b/Misc/NEWS	Mon Jul 18 07:53:13 2016 +0000
@@ -13,6 +13,9 @@
 - Issue #27473: Fixed possible integer overflow in str, unicode and bytearray
   concatenations and repetitions.  Based on patch by Xiang Zhang.
 
+- Issue #27507: Add integer overflow check in bytearray.extend().  Patch by
+  Xiang Zhang.
+
 - Issue #23908: os functions, open() and the io.FileIO constructor now reject
   unicode paths with embedded null character on Windows instead of silently
   truncating them.
diff -r 345ec7455b75 -r 6e166b66aa44 Objects/bytearrayobject.c
--- a/Objects/bytearrayobject.c	Thu Jul 14 22:00:03 2016 -0700
+++ b/Objects/bytearrayobject.c	Mon Jul 18 07:53:13 2016 +0000
@@ -2322,7 +2322,17 @@
         Py_DECREF(item);
 
         if (len >= buf_size) {
-            buf_size = len + (len >> 1) + 1;
+            Py_ssize_t addition;
+            if (len == PY_SSIZE_T_MAX) {
+                Py_DECREF(it);
+                Py_DECREF(bytearray_obj);
+                return PyErr_NoMemory();
+            }
+            addition = len >> 1;
+            if (addition > PY_SSIZE_T_MAX - len - 1)
+                buf_size = PY_SSIZE_T_MAX;
+            else
+                buf_size = len + addition + 1;
             if (PyByteArray_Resize((PyObject *)bytearray_obj, buf_size) < 0) {
                 Py_DECREF(it);
                 Py_DECREF(bytearray_obj);