Commit d9bf7f41 authored by T. Wouters's avatar T. Wouters Committed by GitHub

[2.7] bpo-36149 Fix potential use of uninitialized memory in cPickle (#12105)

Fix off-by-one bug in cPickle that caused it to use uninitialised memory on truncated pickles read from FILE*s.
parent 84b5ac9b
Fix use of uninitialized memory in cPickle when reading a truncated pickle
from a file object.
......@@ -586,12 +586,15 @@ readline_file(Unpicklerobject *self, char **s)
while (1) {
Py_ssize_t bigger;
char *newbuf;
for (; i < (self->buf_size - 1); i++) {
if (feof(self->fp) ||
(self->buf[i] = getc(self->fp)) == '\n') {
self->buf[i + 1] = '\0';
while (i < (self->buf_size - 1)) {
int newchar = getc(self->fp);
if (newchar != EOF) {
self->buf[i++] = newchar;
}
if (newchar == EOF || newchar == '\n') {
self->buf[i] = '\0';
*s = self->buf;
return i + 1;
return i;
}
}
if (self->buf_size > (PY_SSIZE_T_MAX >> 1)) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment