[Python-checkins] cpython (merge 3.3 -> default): (Merge 3.3) Issue #18135: ssl.SSLSocket.write() now raises an OverflowError if

Tue Jun 25 00:44:05 CEST 2013

http://hg.python.org/cpython/rev/12a388024d5b
changeset: 84333:12a388024d5b
parent: 84331:dfc020b4b123
parent: 84332:bfede07268a1
user: Victor Stinner <victor.stinner at gmail.com>
date: Tue Jun 25 00:43:47 2013 +0200
summary:
 (Merge 3.3) Issue #18135: ssl.SSLSocket.write() now raises an OverflowError if
the input string in longer than 2 gigabytes, and
ssl.SSLContext.load_cert_chain() raises a ValueError if the password is longer
than 2 gigabytes. The ssl module does not support partial write.
files:
 Misc/NEWS | 8 +++++---
 Modules/_ssl.c | 9 +++++++--
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -129,12 +129,14 @@
 Library
 -------
 
+
 - Issue #11390: Add -o and -f command line options to the doctest CLI to
 specify doctest options (and convert it to using argparse).
 
-- Issue #18135: Fix a possible integer overflow in ssl.SSLSocket.write()
- and in ssl.SSLContext.load_cert_chain() for strings and passwords longer than
- 2 gigabytes.
+- Issue #18135: ssl.SSLSocket.write() now raises an OverflowError if the input
+ string in longer than 2 gigabytes, and ssl.SSLContext.load_cert_chain()
+ raises a ValueError if the password is longer than 2 gigabytes. The ssl
+ module does not support partial write.
 
 - Issue #11016: Add C implementation of the stat module as _stat.
 
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -1338,6 +1338,12 @@
 return NULL;
 }
 
+ if (buf.len > INT_MAX) {
+ PyErr_Format(PyExc_OverflowError,
+ "string longer than %d bytes", INT_MAX);
+ goto error;
+ }
+
 /* just in case the blocking state of the socket has been changed */
 nonblocking = (sock->sock_timeout >= 0.0);
 BIO_set_nbio(SSL_get_rbio(self->ssl), nonblocking);
@@ -1358,9 +1364,8 @@
 goto error;
 }
 do {
- len = (int)Py_MIN(buf.len, INT_MAX);
 PySSL_BEGIN_ALLOW_THREADS
- len = SSL_write(self->ssl, buf.buf, len);
+ len = SSL_write(self->ssl, buf.buf, (int)buf.len);
 err = SSL_get_error(self->ssl, len);
 PySSL_END_ALLOW_THREADS
 if (PyErr_CheckSignals()) {
-- 
Repository URL: http://hg.python.org/cpython
