[Python-checkins] python/dist/src/PC _winreg.c,1.14,1.15

Sun Nov 30 17:01:47 EST 2003

Update of /cvsroot/python/python/dist/src/PC
In directory sc8-pr-cvs1:/tmp/cvs-serv9905
Modified Files:
	_winreg.c 
Log Message:
Remove all uses of alloca() from this module. The alloca() return value
isn't checked, and it *is* possible that a very large alloca() call is
made, e.g. when a large registry value is being read. I don't know if
alloca() in that case returns NULL or returns a pointer pointing outside
the stack, and I don't want to know -- I've simply replaced all calls to
alloca() with either PyMem_Malloc() or PyString_FromStringAndSize(NULL,)
as appropriate, followed by a size check. This addresses SF buf 851056.
Will backport to 2.3 next.
Index: _winreg.c
===================================================================
RCS file: /cvsroot/python/python/dist/src/PC/_winreg.c,v
retrieving revision 1.14
retrieving revision 1.15
diff -C2 -d -r1.14 -r1.15
*** _winreg.c	15 Jan 2003 23:38:15 -0000	1.14
--- _winreg.c	30 Nov 2003 22:01:43 -0000	1.15
***************
*** 1032,1035 ****
--- 1032,1036 ----
 	int index;
 	long rc;
+ 	PyObject *retStr;
 	char *retBuf;
 	DWORD len;
***************
*** 1046,1054 ****
 							 "RegQueryInfoKey");
 	++len; /* include null terminator */
! 	retBuf = (char *)alloca(len);
 
! 	if ((rc = RegEnumKey(hKey, index, retBuf, len)) != ERROR_SUCCESS)
 		return PyErr_SetFromWindowsErrWithFunction(rc, "RegEnumKey");
! 	return Py_BuildValue("s", retBuf);
 }
 
--- 1047,1061 ----
 							 "RegQueryInfoKey");
 	++len; /* include null terminator */
! 	retStr = PyString_FromStringAndSize(NULL, len);
! 	if (retStr == NULL)
! 		return NULL;
! 	retBuf = PyString_AS_STRING(retStr);
 
! 	if ((rc = RegEnumKey(hKey, index, retBuf, len)) != ERROR_SUCCESS) {
! 		Py_DECREF(retStr);
 		return PyErr_SetFromWindowsErrWithFunction(rc, "RegEnumKey");
! 	}
! 	_PyString_Resize(&retStr, strlen(retBuf));
! 	return retStr;
 }
 
***************
*** 1081,1086 ****
 	++retValueSize; /* include null terminators */
 	++retDataSize;
! 	retValueBuf = (char *)alloca(retValueSize);
! 	retDataBuf = (char *)alloca(retDataSize);
 
 	Py_BEGIN_ALLOW_THREADS
--- 1088,1099 ----
 	++retValueSize; /* include null terminators */
 	++retDataSize;
! 	retValueBuf = (char *)PyMem_Malloc(retValueSize);
! 	if (retValueBuf == NULL)
! 		return PyErr_NoMemory();
! 	retDataBuf = (char *)PyMem_Malloc(retDataSize);
! 	if (retDataBuf == NULL) {
! 		PyMem_Free(retValueBuf);
! 		return PyErr_NoMemory();
! 	}
 
 	Py_BEGIN_ALLOW_THREADS
***************
*** 1095,1106 ****
 	Py_END_ALLOW_THREADS
 
! 	if (rc != ERROR_SUCCESS)
! 		return PyErr_SetFromWindowsErrWithFunction(rc,
! 							 "PyRegEnumValue");
 	obData = Reg2Py(retDataBuf, retDataSize, typ);
! 	if (obData == NULL)
! 		return NULL;
 	retVal = Py_BuildValue("sOi", retValueBuf, obData, typ);
 	Py_DECREF(obData);
 	return retVal;
 }
--- 1108,1126 ----
 	Py_END_ALLOW_THREADS
 
! 	if (rc != ERROR_SUCCESS) {
! 		retVal = PyErr_SetFromWindowsErrWithFunction(rc,
! 							 "PyRegEnumValue");
! 		goto fail;
! 	}
 	obData = Reg2Py(retDataBuf, retDataSize, typ);
! 	if (obData == NULL) {
! 		retVal = NULL;
! 		goto fail;
! 	}
 	retVal = Py_BuildValue("sOi", retValueBuf, obData, typ);
 	Py_DECREF(obData);
+ fail:
+ 	PyMem_Free(retValueBuf);
+ 	PyMem_Free(retDataBuf);
 	return retVal;
 }
***************
*** 1207,1214 ****
 	PyObject *obKey;
 	char *subKey;
- 
 	long rc;
 	char *retBuf;
 	long bufSize = 0;
 	if (!PyArg_ParseTuple(args, "Oz:QueryValue", &obKey, &subKey))
 		return NULL;
--- 1227,1235 ----
 	PyObject *obKey;
 	char *subKey;
 	long rc;
+ 	PyObject *retStr;
 	char *retBuf;
 	long bufSize = 0;
+ 
 	if (!PyArg_ParseTuple(args, "Oz:QueryValue", &obKey, &subKey))
 		return NULL;
***************
*** 1220,1229 ****
 		return PyErr_SetFromWindowsErrWithFunction(rc,
 							 "RegQueryValue");
! 	retBuf = (char *)alloca(bufSize);
 	if ((rc = RegQueryValue(hKey, subKey, retBuf, &bufSize))
! 	 != ERROR_SUCCESS)
 		return PyErr_SetFromWindowsErrWithFunction(rc,
 							 "RegQueryValue");
! 	return Py_BuildValue("s", retBuf);
 }
 
--- 1241,1256 ----
 		return PyErr_SetFromWindowsErrWithFunction(rc,
 							 "RegQueryValue");
! 	retStr = PyString_FromStringAndSize(NULL, bufSize);
! 	if (retStr == NULL)
! 		return NULL;
! 	retBuf = PyString_AS_STRING(retStr);
 	if ((rc = RegQueryValue(hKey, subKey, retBuf, &bufSize))
! 	 != ERROR_SUCCESS) {
! 		Py_DECREF(retStr);
 		return PyErr_SetFromWindowsErrWithFunction(rc,
 							 "RegQueryValue");
! 	}
! 	_PyString_Resize(&retStr, strlen(retBuf));
! 	return retStr;
 }
 
***************
*** 1253,1263 ****
 		return PyErr_SetFromWindowsErrWithFunction(rc,
 							 "RegQueryValueEx");
! 	retBuf = (char *)alloca(bufSize);
 	if ((rc = RegQueryValueEx(hKey, valueName, NULL,
 				 &typ, (BYTE *)retBuf, &bufSize))
! 	 != ERROR_SUCCESS)
 		return PyErr_SetFromWindowsErrWithFunction(rc,
 							 "RegQueryValueEx");
 	obData = Reg2Py(retBuf, bufSize, typ);
 	if (obData == NULL)
 		return NULL;
--- 1280,1295 ----
 		return PyErr_SetFromWindowsErrWithFunction(rc,
 							 "RegQueryValueEx");
! 	retBuf = (char *)PyMem_Malloc(bufSize);
! 	if (retBuf == NULL)
! 		return PyErr_NoMemory();
 	if ((rc = RegQueryValueEx(hKey, valueName, NULL,
 				 &typ, (BYTE *)retBuf, &bufSize))
! 	 != ERROR_SUCCESS) {
! 		PyMem_Free(retBuf);
 		return PyErr_SetFromWindowsErrWithFunction(rc,
 							 "RegQueryValueEx");
+ 	}
 	obData = Reg2Py(retBuf, bufSize, typ);
+ 	PyMem_Free((void *)retBuf);
 	if (obData == NULL)
 		return NULL;