Skip to content

Commit 992d5f5

Browse files
committed
Remove length cap, and early exit on negative len.
Py_ssize_t can't get as big as Py_size_t, _Py_read checks max length
1 parent b75bc9b commit 992d5f5

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

Modules/posixmodule.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11451,9 +11451,11 @@ static Py_ssize_t
1145111451
os_readinto_impl(PyObject *module, int fd, Py_buffer *buffer)
1145211452
/*[clinic end generated code: output=8091a3513c683a80 input=810c820f4d9b1c6b]*/
1145311453
{
11454-
// Cap to max read size to prevent overflow in cast to size_t for _Py_read.
11455-
size_t length = Py_MIN(buffer->len, _PY_READ_MAX);
11456-
return _Py_read(fd, buffer->buf, length);
11454+
if (buffer->len < 0) {
11455+
errno = EINVAL
11456+
return posix_error();
11457+
}
11458+
return _Py_read(fd, buffer->buf, buffer->len);
1145711459
}
1145811460

1145911461
#if (defined(HAVE_SENDFILE) && (defined(__FreeBSD__) || defined(__DragonFly__) \

0 commit comments

Comments
 (0)