3698 Commits

Author SHA1 Message Date
Amaury Forgeot d'Arc
a5f3ceb21e #4317: Fix an Array Bounds Read in imageop.rgb2rgb8.
Backport of r67266
2008-11-18 22:49:39 +00:00
Matthias Klose
3a87f93c42 - Security Issue #2: imageop did not validate arguments correctly and could
segfault as a result. CVE-2008-4864.

backport r66689
2008-11-12 07:29:23 +00:00
Matthias Klose
01feb5ad8d - Issue #2586: Fix CVE-2008-1721, zlib crash from
zlib.decompressobj().flush(val) when val is not positive.
2008-11-12 07:02:24 +00:00
Matthias Klose
8ad5f451e2 - Issue #1179: Fix CVE-2007-4965 and CVE-2008-1679, multiple integer
overflows in the imageop and rgbimgmodule modules.
2008-11-12 06:54:33 +00:00
Neal Norwitz
b93d7d52b5 Security patches from Apple: prevent int overflow when allocating memory 2008-07-31 17:04:32 +00:00
Neal Norwitz
46b3a79459 Backport r65182. This change modified from using the unsigned max value
to the signed max value similar to 2.5 and trunk.

Issue #2620: Overflow checking when allocating or reallocating memory
was not always being done properly in some python types and extension
modules.  PyMem_MALLOC, PyMem_REALLOC, PyMem_NEW and PyMem_RESIZE have
all been updated to perform better checks and places in the code that
would previously leak memory on the error path when such an allocation
failed have been fixed.
2008-07-28 05:22:45 +00:00
Martin v. Löwis
c8ed4ff565 Backport of r60793:
Added checks for integer overflows, contributed by Google. Some are
only available if asserts are left in the code, in cases where they
can't be triggered from Python code.
2008-03-02 19:20:32 +00:00
Martin v. Löwis
0cc3ea620c Revert the following revisions, as they don't fix security
problems:
52448, 52468, 52472, 52475, 52646, 52797, 52802, 52863, 52999, 53001,
53101, 53371, 53373, 53383, 53384, 53736, 53812, 53921, 55578, 55580,
55581, 55772, 55775, 56557, 57093, 57094, 58630, 60114
2008-03-02 17:47:51 +00:00
Hye-Shik Chang
bc7902fb89 (Backport from r55770)
Bug #1728403: Fix a bug that CJKCodecs StreamReader hangs when it
reads a file that ends with incomplete sequence and sizehint argument
for .read() is specified.
2007-06-05 19:02:59 +00:00
Anthony Baxter
3d62ffe0fa Backport 50567
#1494314: Fix a regression with high-numbered sockets in 2.4.3. This
means that select() on sockets > FD_SETSIZE (typically 1024) work again.
The patch makes sockets use poll() internally where available.
2006-10-10 16:20:41 +00:00
Martin v. Löwis
b8f82e6feb Backport r45505, r45573, r45576
- reset errno before calling confstr - use confstr() doc to simplify
  checks afterwards
- Correct implementation and documentation of os.confstr.  Add a simple
  test case.  I've yet to figure out how to provoke a None return I can test.
- Address issues brought up by MvL on python-checkins.
  I tested this with valgrind on amd64.

  The man pages I found for diff architectures are inconsistent on this.
  I'm not entirely sure this change is correct for all architectures
  either.

  Perhaps we should just over-allocate and not worry about it?

The change to return None instead of "" in case of unconfigured
values has not been backported.
2006-10-09 19:29:06 +00:00
Andrew M. Kuchling
cebdc5e373 [Partial backport of r45947 | neal.norwitz]
Fix problems found by Coverity.

_ssl.c: under fail: self is DECREF'd, but it would have been NULL.

_csv.c: I'm not sure if lineterminator could have been anything other than
a string.  However, other string method calls are checked, so check this
one too.
2006-10-09 18:30:13 +00:00
Ronald Oussoren
392cafba4f Port of universal binary support for Mac OSX from python 2.5. This takes away
the need for the out-of-tree universal binary support that was used to build
the 2.4.3 installer.

Missing here relative to that tree are some changes to IDLE, IMHO those patches
aren't appropriate for the 2.4 branch and users are better of using 2.5's IDLE.
2006-10-08 17:41:25 +00:00
Hye-Shik Chang
2d09be9e48 Backport from trunk r52223:
Bug #1572832: fix a bug in ISO-2022 codecs which may cause segfault
when encoding non-BMP unicode characters.  (Submitted by Ray Chason)
2006-10-08 13:56:00 +00:00
Andrew M. Kuchling
da604c1992 [Backport r50783 | neal.norwitz. The bytes_left code is complicated,
but looks correct on a casual inspection and hasn't been modified
 in the trunk.  Does anyone want to review further?]

Ensure we don't write beyond errText.  I think I got this right, but
it definitely could use some review to ensure I'm not off by one
and there's no possible overflow/wrap-around of bytes_left.
Reported by Klocwork #1.

Fix a problem if there is a failure allocating self->db.
Found with failmalloc.
2006-10-05 18:49:36 +00:00
Andrew M. Kuchling
978809518d [Partial backport of r51218 | neal.norwitz -- the changes to ast.c, symtable.c,
and _elementtree.c weren't applicable]

Klocwork made another run and found a bunch more problems.
This is the first batch of fixes that should be easy to verify based on context.
This fixes problem numbers: 220 (ast), 323-324 (symtable),
321-322 (structseq), 215 (array), 210 (hotshot), 182 (codecs), 209 (etree).
2006-10-05 18:37:08 +00:00
Andrew M. Kuchling
9781e5d97e [Partial backport of r50773 | neal.norwitz -- other parts of this patch
applied to pyarena.c, compile.c, and symtable.c, which were different in 2.4.]

Fix more memory allocation issues found with failmalloc.
2006-10-05 18:22:02 +00:00
Andrew M. Kuchling
af4defb79d [Backport r52147 | andrew.kuchling]
Cause a PyObject_Malloc() failure to trigger a MemoryError, and then
add 'if (PyErr_Occurred())' checks to various places so that NULL is
returned properly.
2006-10-05 17:30:48 +00:00
Andrew M. Kuchling
a1ade3e925 [Backport r51223 | neal.norwitz]
If _stat_float_times is false, we will try to INCREF ival which could be NULL.
Return early in that case.  The caller checks for PyErr_Occurred so this
should be ok.

Klocwork #297
2006-10-05 17:24:08 +00:00
Andrew M. Kuchling
165e797817 [Backport r51224 | neal.norwitz]
Move the assert which checks for a NULL pointer first.
Klocwork #274.
2006-10-05 17:22:15 +00:00
Andrew M. Kuchling
68e1e0372b [Backport r51255 | neal.norwitz]
Really address the issue of where to place the assert for leftblock.
(Followup of Klocwork 274)
2006-10-05 17:06:59 +00:00
Andrew M. Kuchling
589f333dfa [Backport r51225 | neal.norwitz]
Try to handle a malloc failure.  I'm not entirely sure this is correct.
There might be something else we need to do to handle the exception.

Klocwork # 212-213

[I think this needs more work; a malloc() failure will cause a match to fail,
 but nothing raises MemoryError.  I'll work on this on the trunk and backport.
 --amk]
2006-10-04 13:30:17 +00:00
Andrew M. Kuchling
d3499a3071 [Backport r51232 | neal.norwitz]
Verify verdat which is returned from malloc is not NULL.
Ensure we don't pass NULL to free.

Klocwork #306 (at least the first part, checking malloc)
2006-10-04 13:20:05 +00:00
Andrew M. Kuchling
3184f24de6 [Backport r51251 | neal.norwitz]
Handle malloc and fopen failures more gracefully.

Klocwork 180-181
2006-10-04 13:14:48 +00:00
Andrew M. Kuchling
a2a1661554 [Backport r51226 | neal.norwitz]
I'm not sure why this code allocates this string for the error message.
I think it would be better to always use snprintf and have the format
limit the size of the name appropriately (like %.200s).

Klocwork #340
2006-10-04 13:12:26 +00:00