Commit 041a4ee9 authored by Zackery Spytz's avatar Zackery Spytz Committed by Serhiy Storchaka

bpo-25943: Check for integer overflow in bsddb's DB_join(). (GH-8392)

parent 32522050
...@@ -2257,7 +2257,7 @@ static PyObject* ...@@ -2257,7 +2257,7 @@ static PyObject*
DB_join(DBObject* self, PyObject* args) DB_join(DBObject* self, PyObject* args)
{ {
int err, flags=0; int err, flags=0;
int length, x; Py_ssize_t length, x;
PyObject* cursorsObj; PyObject* cursorsObj;
DBC** cursors; DBC** cursors;
DBC* dbc; DBC* dbc;
...@@ -2274,6 +2274,12 @@ DB_join(DBObject* self, PyObject* args) ...@@ -2274,6 +2274,12 @@ DB_join(DBObject* self, PyObject* args)
} }
length = PyObject_Length(cursorsObj); length = PyObject_Length(cursorsObj);
if (length == -1) {
return NULL;
}
if (length >= PY_SSIZE_T_MAX / sizeof(DBC*)) {
return PyErr_NoMemory();
}
cursors = malloc((length+1) * sizeof(DBC*)); cursors = malloc((length+1) * sizeof(DBC*));
if (!cursors) { if (!cursors) {
PyErr_NoMemory(); PyErr_NoMemory();
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment