changeset:   94575:b82cc9180a78
branch:      3.4
parent:      94570:84a05605caeb
parent:      94574:ab2e79c6cf6b
user:        Benjamin Peterson <benjamin@python.org>
date:        Mon Feb 09 20:58:52 2015 -0500
files:       Misc/NEWS Modules/_winapi.c
description:
merge 3.3 (#23361)


diff -r 84a05605caeb -r b82cc9180a78 Misc/NEWS
--- a/Misc/NEWS	Mon Feb 09 08:07:12 2015 +0100
+++ b/Misc/NEWS	Mon Feb 09 20:58:52 2015 -0500
@@ -13,6 +13,7 @@
 Library
 -------
 
+- Issue #23361: Fix possible overflow in Windows subprocess creation code.
 
 What's New in Python 3.4.3rc1?
 ==============================
diff -r 84a05605caeb -r b82cc9180a78 Modules/_winapi.c
--- a/Modules/_winapi.c	Mon Feb 09 08:07:12 2015 +0100
+++ b/Modules/_winapi.c	Mon Feb 09 20:58:52 2015 -0500
@@ -535,13 +535,23 @@
                 "environment can only contain strings");
             goto error;
         }
+        if (totalsize > PY_SSIZE_T_MAX - PyUnicode_GET_LENGTH(key) - 1) {
+            PyErr_SetString(PyExc_OverflowError, "environment too long");
+            goto error;
+        }
         totalsize += PyUnicode_GET_LENGTH(key) + 1;    /* +1 for '=' */
+        if (totalsize > PY_SSIZE_T_MAX - PyUnicode_GET_LENGTH(value) - 1) {
+            PyErr_SetString(PyExc_OverflowError, "environment too long");
+            goto error;
+        }
         totalsize += PyUnicode_GET_LENGTH(value) + 1;  /* +1 for '\0' */
     }
 
-    buffer = PyMem_Malloc(totalsize * sizeof(Py_UCS4));
-    if (! buffer)
+    buffer = PyMem_NEW(Py_UCS4, totalsize);
+    if (! buffer) {
+        PyErr_NoMemory();
         goto error;
+    }
     p = buffer;
     end = buffer + totalsize;