Kaydet (Commit) 79e42a0e authored tarafından Gregory P. Smith's avatar Gregory P. Smith

Fix zlib crash from zlib.decompressobj().flush(val) when val was not positive.

It tried to allocate negative or zero memory.  That fails.
üst e41b0061
...@@ -83,6 +83,11 @@ class ExceptionTestCase(unittest.TestCase): ...@@ -83,6 +83,11 @@ class ExceptionTestCase(unittest.TestCase):
# verify failure on building decompress object with bad params # verify failure on building decompress object with bad params
self.assertRaises(ValueError, zlib.decompressobj, 0) self.assertRaises(ValueError, zlib.decompressobj, 0)
def test_decompressobj_badflush(self):
# verify failure on calling decompressobj.flush with bad params
self.assertRaises(ValueError, zlib.decompressobj().flush, 0)
self.assertRaises(ValueError, zlib.decompressobj().flush, -1)
class CompressTestCase(unittest.TestCase): class CompressTestCase(unittest.TestCase):
......
...@@ -774,6 +774,10 @@ PyZlib_unflush(compobject *self, PyObject *args) ...@@ -774,6 +774,10 @@ PyZlib_unflush(compobject *self, PyObject *args)
if (!PyArg_ParseTuple(args, "|i:flush", &length)) if (!PyArg_ParseTuple(args, "|i:flush", &length))
return NULL; return NULL;
if (length <= 0) {
PyErr_SetString(PyExc_ValueError, "length must be greater than zero");
return NULL;
}
if (!(retval = PyString_FromStringAndSize(NULL, length))) if (!(retval = PyString_FromStringAndSize(NULL, length)))
return NULL; return NULL;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment