Skip to content

Commit 5baaac5

Browse files
committed
vstr_init_len: Don't crash if (size_t)-1 is passed
In this unusual case, (len + 1) is zero, the allocation in vstr_init succeeds (allocating 1 byte), and then the caller is likely to erroneously access outside the allocated region, for instance with a memset(). This could be triggered with os.urandom(-1) after it was converted to use mp_obj_new_bytes_of_zeros.
1 parent 22644d3 commit 5baaac5

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

py/vstr.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ void vstr_init(vstr_t *vstr, size_t alloc) {
5050
// Init the vstr so it allocs exactly enough ram to hold a null-terminated
5151
// string of the given length, and set the length.
5252
void vstr_init_len(vstr_t *vstr, size_t len) {
53+
if(len == SIZE_MAX)
54+
m_malloc_fail(len);
5355
vstr_init(vstr, len + 1);
5456
vstr->len = len;
5557
}

0 commit comments

Comments
 (0)