Detect strlen() overflow

vstinner · vstinner · commit d8a4659ced24 · 2025-03-31T14:10:31.000+02:00
diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
@@ -4032,7 +4032,12 @@ PyBytesWriter_WriteBytes(PyBytesWriter *writer,
                          const void *bytes, Py_ssize_t size)
 {
     if (size < 0) {
-        size = strlen(bytes);
+        size_t len = strlen(bytes);
+        if (len > (size_t)PY_SSIZE_T_MAX) {
+            PyErr_NoMemory();
+            return NULL;
+        }
+        size = (Py_ssize_t)len;
     }
 
     Py_ssize_t pos = writer->size;

Original file line number	Diff line number	Diff line change
`@@ -4032,7 +4032,12 @@ PyBytesWriter_WriteBytes(PyBytesWriter *writer,`
`4032`	`4032`	`const void *bytes, Py_ssize_t size)`
`4033`	`4033`	`{`
`4034`	`4034`	`if (size < 0) {`
`4035`		`- size = strlen(bytes);`
	`4035`	`+ size_t len = strlen(bytes);`
	`4036`	`+ if (len > (size_t)PY_SSIZE_T_MAX) {`
	`4037`	`+ PyErr_NoMemory();`
	`4038`	`+ return NULL;`
	`4039`	`+ }`
	`4040`	`+ size = (Py_ssize_t)len;`
`4036`	`4041`	`}`
`4037`	`4042`
`4038`	`4043`	`Py_ssize_t pos = writer->size;`