Commit 3d4fabb2 authored by Alexey Izbyshev's avatar Alexey Izbyshev Committed by Victor Stinner

bpo-35090: Fix potential division by zero in allocator wrappers (GH-10174)

* Fix potential division by zero in BZ2_Malloc()
* Avoid division by zero in PyLzma_Malloc()
* Avoid division by zero and integer overflow in PyZlib_Malloc()

Reported by Svace static analyzer.
parent 68d6dc07
...@@ -277,11 +277,11 @@ BZ2_Malloc(void* ctx, int items, int size) ...@@ -277,11 +277,11 @@ BZ2_Malloc(void* ctx, int items, int size)
{ {
if (items < 0 || size < 0) if (items < 0 || size < 0)
return NULL; return NULL;
if ((size_t)items > (size_t)PY_SSIZE_T_MAX / (size_t)size) if (size != 0 && (size_t)items > (size_t)PY_SSIZE_T_MAX / (size_t)size)
return NULL; return NULL;
/* PyMem_Malloc() cannot be used: compress() and decompress() /* PyMem_Malloc() cannot be used: compress() and decompress()
release the GIL */ release the GIL */
return PyMem_RawMalloc(items * size); return PyMem_RawMalloc((size_t)items * (size_t)size);
} }
static void static void
......
...@@ -108,7 +108,7 @@ catch_lzma_error(lzma_ret lzret) ...@@ -108,7 +108,7 @@ catch_lzma_error(lzma_ret lzret)
static void* static void*
PyLzma_Malloc(void *opaque, size_t items, size_t size) PyLzma_Malloc(void *opaque, size_t items, size_t size)
{ {
if (items > (size_t)PY_SSIZE_T_MAX / size) if (size != 0 && items > (size_t)PY_SSIZE_T_MAX / size)
return NULL; return NULL;
/* PyMem_Malloc() cannot be used: /* PyMem_Malloc() cannot be used:
the GIL is not held when lzma_code() is called */ the GIL is not held when lzma_code() is called */
......
...@@ -117,11 +117,11 @@ newcompobject(PyTypeObject *type) ...@@ -117,11 +117,11 @@ newcompobject(PyTypeObject *type)
static void* static void*
PyZlib_Malloc(voidpf ctx, uInt items, uInt size) PyZlib_Malloc(voidpf ctx, uInt items, uInt size)
{ {
if (items > (size_t)PY_SSIZE_T_MAX / size) if (size != 0 && items > (size_t)PY_SSIZE_T_MAX / size)
return NULL; return NULL;
/* PyMem_Malloc() cannot be used: the GIL is not held when /* PyMem_Malloc() cannot be used: the GIL is not held when
inflate() and deflate() are called */ inflate() and deflate() are called */
return PyMem_RawMalloc(items * size); return PyMem_RawMalloc((size_t)items * (size_t)size);
} }
static void static void
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment