homepage

This issue tracker has been migrated to GitHub , and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: alp_readsamps() overflow leads to memory corruption in ?unused? SGI extension module almodule.c
Type: security Stage: resolved
Components: Extension Modules Versions: Python 2.5
process
Status: closed Resolution: wont fix
Dependencies: Superseder:
Assigned To: Nosy List: jnferguson, r.david.murray
Priority: normal Keywords:

Created on 2008年04月08日 16:31 by jnferguson, last changed 2022年04月11日 14:56 by admin. This issue is now closed.

Messages (2)
msg65188 - (view) Author: Justin Ferguson (jnferguson) Date: 2008年04月08日 16:31
You guys should probably just remove the SGI modules, the code looks
like it hasn't been touched in some time and hasn't gone through the
same security checks as other pieces of code. Sorry I have no
repro's/pocs, I don't have an irix box either though ;]
integer overflow/misallocation occurs at 1071, write to bad memory at 1076
1042 alp_readsamps(alpobject *self, PyObject *args)
1043 {
1044 long count;
1045 PyObject *v;
1046 ALconfig c;
1047 int width;
1048 int ret;
1049 
1050 if (!PyArg_ParseTuple(args, "l:readsamps", &count))
1051 return NULL;
1052 
1053 if (count <= 0) {
1054 PyErr_SetString(ErrorObject, "al.readsamps : arg <=
0");
1055 return NULL;
1056 }
1057 
1058 c = ALgetconfig(self->port);
1059 #ifdef AL_405
1060 width = ALgetsampfmt(c);
1061 if (width == AL_SAMPFMT_FLOAT)
1062 width = sizeof(float);
1063 else if (width == AL_SAMPFMT_DOUBLE)
1064 width = sizeof(double);
1065 else
1066 width = ALgetwidth(c);
1067 #else
1068 width = ALgetwidth(c);
1069 #endif /* AL_405 */
1070 ALfreeconfig(c);
1071 v = PyString_FromStringAndSize((char *)NULL, width * count);
1072 if (v == NULL)
1073 return NULL;
1074 
1075 Py_BEGIN_ALLOW_THREADS
1076 ret = ALreadsamps(self->port, (void *)
PyString_AsString(v), count);
1077 Py_END_ALLOW_THREADS
1078 if (ret == -1) {
1079 Py_DECREF(v);
1080 return NULL;
1081 }
1082 
1083 return (v);
1084 }
msg84399 - (view) Author: R. David Murray (r.david.murray) * (Python committer) Date: 2009年03月29日 14:01
closed per comments in issue2591.
History
Date User Action Args
2022年04月11日 14:56:33adminsetgithub: 46846
2009年03月29日 14:01:30r.david.murraysetstatus: open -> closed

nosy: + r.david.murray
messages: + msg84399

resolution: wont fix
stage: resolved
2008年04月08日 16:31:43jnfergusoncreate

AltStyle によって変換されたページ (->オリジナル) /