[Python-checkins] cpython (merge 3.3 -> 3.4): merge 3.3

Sat Jun 27 21:18:17 CEST 2015

https://hg.python.org/cpython/rev/4f2333bb36f4
changeset: 96685:4f2333bb36f4
branch: 3.4
parent: 96678:368db4b1ced9
parent: 96684:acd5c9118931
user: Benjamin Peterson <benjamin at python.org>
date: Sat Jun 27 13:56:46 2015 -0500
summary:
 merge 3.3
files:
 Misc/NEWS | 2 ++
 Modules/_pickle.c | 26 ++++++++++----------------
 2 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -91,6 +91,8 @@
 - Issue #23796: peek and read1 methods of BufferedReader now raise ValueError
 if they called on a closed object. Patch by John Hergenroeder.
 
+- Fix possible integer overflows in the pickle module.
+
 - Issue #22931: Allow '[' and ']' in cookie values.
 
 - Issue #20274: Remove ignored and erroneous "kwargs" parameters from three
diff --git a/Modules/_pickle.c b/Modules/_pickle.c
--- a/Modules/_pickle.c
+++ b/Modules/_pickle.c
@@ -428,9 +428,7 @@
 if (new_allocated > PY_SSIZE_T_MAX - allocated)
 goto nomemory;
 new_allocated += allocated;
- if (new_allocated > (PY_SSIZE_T_MAX / sizeof(PyObject *)))
- goto nomemory;
- data = PyMem_REALLOC(data, new_allocated * sizeof(PyObject *));
+ PyMem_RESIZE(data, PyObject *, new_allocated);
 if (data == NULL)
 goto nomemory;
 
@@ -660,7 +658,7 @@
 /* The table we get from _New() is probably smaller than we wanted.
 Free it and allocate one that's the right size. */
 PyMem_FREE(new->mt_table);
- new->mt_table = PyMem_MALLOC(self->mt_allocated * sizeof(PyMemoEntry));
+ new->mt_table = PyMem_NEW(PyMemoEntry, self->mt_allocated);
 if (new->mt_table == NULL) {
 PyMem_FREE(new);
 PyErr_NoMemory();
@@ -755,7 +753,7 @@
 
 /* Allocate new table. */
 oldtable = self->mt_table;
- self->mt_table = PyMem_MALLOC(new_size * sizeof(PyMemoEntry));
+ self->mt_table = PyMem_NEW(PyMemoEntry, new_size);
 if (self->mt_table == NULL) {
 self->mt_table = oldtable;
 PyErr_NoMemory();
@@ -1261,16 +1259,14 @@
 _Unpickler_ResizeMemoList(UnpicklerObject *self, Py_ssize_t new_size)
 {
 Py_ssize_t i;
- PyObject **memo;
 
 assert(new_size > self->memo_size);
 
- memo = PyMem_REALLOC(self->memo, new_size * sizeof(PyObject *));
- if (memo == NULL) {
+ PyMem_RESIZE(self->memo, PyObject *, new_size);
+ if (self->memo == NULL) {
 PyErr_NoMemory();
 return -1;
 }
- self->memo = memo;
 for (i = self->memo_size; i < new_size; i++)
 self->memo[i] = NULL;
 self->memo_size = new_size;
@@ -1314,7 +1310,7 @@
 static PyObject **
 _Unpickler_NewMemo(Py_ssize_t new_size)
 {
- PyObject **memo = PyMem_MALLOC(new_size * sizeof(PyObject *));
+ PyObject **memo = PyMem_NEW(PyObject *, new_size);
 if (memo == NULL) {
 PyErr_NoMemory();
 return NULL;
@@ -5963,7 +5959,6 @@
 
 if ((self->num_marks + 1) >= self->marks_size) {
 size_t alloc;
- Py_ssize_t *marks;
 
 /* Use the size_t type to check for overflow. */
 alloc = ((size_t)self->num_marks << 1) + 20;
@@ -5974,15 +5969,14 @@
 }
 
 if (self->marks == NULL)
- marks = (Py_ssize_t *) PyMem_Malloc(alloc * sizeof(Py_ssize_t));
+ self->marks = PyMem_NEW(Py_ssize_t, alloc);
 else
- marks = (Py_ssize_t *) PyMem_Realloc(self->marks,
- alloc * sizeof(Py_ssize_t));
- if (marks == NULL) {
+ PyMem_RESIZE(self->marks, Py_ssize_t, alloc);
+ if (self->marks == NULL) {
+ self->marks_size = 0;
 PyErr_NoMemory();
 return -1;
 }
- self->marks = marks;
 self->marks_size = (Py_ssize_t)alloc;
 }
 
-- 
Repository URL: https://hg.python.org/cpython
