Tim Peters ec8c5a9311 Bug 1003471: Python 1.5.2 security vulnerability still present in 2.3.4 ...

That's the title of the report, but the hole was probably plugged since
Python 2.0.  See corresponding checkin to PC/getpathp.c:  a crucial
precondition for joinpath() was neither documented nor verified, and there
are so many callers with so many conditional paths that no "eyeball
analysis" is satisfactory.  Now Python dies with a fatal error if the
precondition isn't satisfied, instead of allowing a buffer overrun.

NOT TESTED!  The Windows version of the patch was, but not this one.  I
don't feel like waiting for someone to notice the patch I attached to the
bug report.  If it doesn't compile, sorry, but fix it <wink>.  If it
does compile, it's "obviously correct".

2004-08-08 01:00:47 +00:00

..

cjkcodecs

Remove CJKCodecs implementation of UTF-7 and UTF-8 codec which

2004-07-28 09:36:52 +00:00

expat

update to Expat 1.95.8

2004-08-03 07:06:22 +00:00

_bisectmodule.c

Any call to insort_{left,right} with a non-list leaked a reference to None

2004-08-02 13:24:54 +00:00

_bsddb.c

Fix memory leak and bump the version per Greg

2004-07-09 23:33:06 +00:00

_codecsmodule.c

Change some declarations from `char * to const char *`. Also added

2004-07-10 21:41:14 +00:00

_csv.c

Use PyArg_UnpackTuple() where possible.

2004-06-20 04:23:19 +00:00

_curses_panel.c

Excise DL_EXPORT/DL_IMPORT from Modules/*. Required adding a prototype

2002-08-02 02:27:13 +00:00

_cursesmodule.c

Fix a leak of a reference on None.

2004-08-04 14:33:28 +00:00

_heapqmodule.c

Improve the documented advice on how to best use heapq.heapreplace().

2004-06-20 09:07:53 +00:00

_hotshot.c

SF bug #808756: refleaks in _hotshot.c.

2004-08-03 08:33:55 +00:00

_localemodule.c

This change implements the following gettext features, as

2004-07-22 18:44:01 +00:00

_randommodule.c

SF bug #812202: randint is always even

2003-10-05 09:09:15 +00:00

_sre.c

Moved SunPro warning suppression into pyport.h and out of individual

2004-07-15 15:54:05 +00:00

_ssl.c

Add a missing decref -- PyErr_SetObject increfs the 'object'!

2004-08-04 14:59:00 +00:00

_testcapimodule.c

Fix silly leak in test used in test_exceptions.

2003-08-15 13:03:30 +00:00

_tkinter.c

Tkapp_New(): Rewrite in C so it compiles again.

2004-08-04 02:16:48 +00:00

_weakref.c

Make weak references subclassable:

2004-07-02 18:57:45 +00:00

.cvsignore

Add Setup.config

2000-06-30 16:09:01 +00:00

addrinfo.h

Add comments at end of every #endif and fix ones already there when for closing

2004-07-10 19:30:39 +00:00

almodule.c

Simplify and speedup uses of Py_BuildValue():

2003-10-12 19:09:37 +00:00

ar_beos

Moved BeOS/ar-fake and BeOS/linkmodule to Modules/ar_beos and

2001-02-16 03:24:50 +00:00

arraymodule.c

Add weakref support to array.array and file objects.

2004-05-31 00:35:52 +00:00

audioop.c

Excise DL_EXPORT/DL_IMPORT from Modules/*. Required adding a prototype

2002-08-02 02:27:13 +00:00

binascii.c

Switch arguments to memset (kudos to MSVC C4318 for finding that)

2004-07-27 15:03:53 +00:00

bsddbmodule.c

add open function to bsddb185 module so the file format sniffing can be

2003-05-06 20:38:52 +00:00

bz2module.c

- Fixed #853061: allow BZ2Compressor.compress() to receive an empty string

2004-02-14 00:02:45 +00:00

ccpython.cc

…

cdmodule.c

Repair widespread misuse of _PyString_Resize. Since it's clear people

2002-04-27 18:44:32 +00:00

cgen.py

Whitespace normalization, via reindent.py.

2004-07-18 06:16:08 +00:00

cgensupport.c

REMOVED all CWI, CNRI and BeOpen copyright markings.

2000-09-01 23:29:29 +00:00

cgensupport.h

REMOVED all CWI, CNRI and BeOpen copyright markings.

2000-09-01 23:29:29 +00:00

clmodule.c

Repair widespread misuse of _PyString_Resize. Since it's clear people

2002-04-27 18:44:32 +00:00

cmathmodule.c

Patch #826074: cmath.log optional base argument, fixes #823209

2004-06-14 07:40:10 +00:00

collectionsmodule.c

Silence a GCC unused variable warning in debug builds.

2004-07-19 00:10:24 +00:00

config.c.in

Removed WITH_CYCLE_GC #ifdef-ery. Holes:

2002-07-07 03:59:34 +00:00

cPickle.c

Patch #995766: Keyword argument support in cPickle.

2004-07-27 05:22:33 +00:00

cryptmodule.c

Excise DL_EXPORT/DL_IMPORT from Modules/*. Required adding a prototype

2002-08-02 02:27:13 +00:00

cStringIO.c

sizeof(char) is 1, by definition, so get rid of that expression in

2004-06-27 17:24:49 +00:00

cstubs

REMOVED all CWI, CNRI and BeOpen copyright markings.

2000-09-01 23:29:29 +00:00

datetimemodule.c

SF patch 876130: add C API to datetime module, from Anthony Tuininga.

2004-06-20 22:41:32 +00:00

dbmmodule.c

Fix SF # 640557, '64-bit' systems and the dbm module

2002-11-22 23:29:31 +00:00

dlmodule.c

Excise DL_EXPORT/DL_IMPORT from Modules/*. Required adding a prototype

2002-08-02 02:27:13 +00:00

errnomodule.c

Getting rid of code dependent on GUSI or the MetroWerks compiler.

2003-11-19 22:52:23 +00:00

fcntlmodule.c

Warn abou missing mutate flag to ioctl. Fixes #696535.

2004-06-03 12:47:26 +00:00

flmodule.c

Simplify and speedup uses of Py_BuildValue():

2003-10-12 19:09:37 +00:00

fmmodule.c

staticforward bites the dust.

2002-07-17 16:30:39 +00:00

fpectlmodule.c

Patch #708495: Port more stuff to OpenVMS.

2003-05-03 09:14:54 +00:00

fpetestmodule.c

Excise DL_EXPORT/DL_IMPORT from Modules/*. Required adding a prototype

2002-08-02 02:27:13 +00:00

gc_weakref.txt

SF bug 839548: Bug in type's GC handling causes segfaults.

2003-11-20 21:21:46 +00:00

gcmodule.c

Convert return value to boolean.

2004-01-04 04:00:13 +00:00

gdbmmodule.c

[Bug #982806] The default argument for opening GDBM files is bogus. Patch #984672 by James Lamanna

2004-07-07 14:19:09 +00:00

getaddrinfo.c

SF #784031: Byte-order bug in socket-module getaddrinfo.c

2003-08-17 21:28:39 +00:00

getbuildinfo.c

Getting rid of all the code inside #ifdef macintosh too.

2003-11-20 01:44:59 +00:00

getnameinfo.c

Remove INET6 define. Use ENABLE_IPV6 instead.

2001-12-02 10:15:37 +00:00

getpath.c

Bug 1003471: Python 1.5.2 security vulnerability still present in 2.3.4

2004-08-08 01:00:47 +00:00

glmodule.c

SF patch #577031, remove PyArg_NoArgs() since it's deprecated

2002-07-28 15:23:23 +00:00

grpmodule.c

grp_getgrgid(), grp_getgrnam(): Patch # 868499, improvement to the error

2004-01-20 21:06:00 +00:00

imageop.c

The format of the string data used in the imageop module is described

2004-01-10 20:43:43 +00:00

imgfile.c

Convert METH_OLDARGS -> METH_VARARGS: also PyArg_Parse -> PyArg_ParseTuple

2002-03-31 15:43:28 +00:00

itertoolsmodule.c

Exercise Jim's VISIT macro.

2004-07-15 05:32:47 +00:00

ld_so_aix

…

ld_so_beos

Remove a hard coded Python version, and a now incorrect relative path. Closes

2001-02-16 03:27:35 +00:00

linuxaudiodev.c

Allow the device name to be passed to linuxaudiodev.open(), for

2002-11-27 22:19:15 +00:00

main.c

Add pystack definition to Misc/gdbinit with some explanation of its behavior

2004-03-01 15:44:05 +00:00

makesetup

[Patch #536769] Add -Xcompiler flag for adding arguments and switches for

2002-03-29 18:00:19 +00:00

makexp_aix

…

mathmodule.c

Patch #871657: Set EDOM for `nan' return values on FreeBSD and OpenBSD.

2004-03-22 08:43:55 +00:00

md5.h

Issue an explicit error when we can't find an appropriate type for

2002-05-29 14:00:22 +00:00

md5c.c

Patch #977074: Move Encode/Decode to the top so gcc can inline them.

2004-08-03 13:08:07 +00:00

md5module.c

typo

2003-07-08 21:17:25 +00:00

mmapmodule.c

Set data pointer to NULL after an error; this keeps the mmap_dealloc() function from trying to do msync(-1);munmap(-1).

2004-05-19 14:39:08 +00:00

mpzmodule.c

Fix memory leaks reported by valgrind

2002-08-14 02:03:50 +00:00

nismodule.c

Add an #ifdef __APPLE__ around typedef of foreachfunc to match Apple's

2004-07-10 00:57:37 +00:00

operator.c

Fix typos.

2003-12-04 22:17:49 +00:00

ossaudiodev.c

SF #832236: merge from release23-maint branch: wrap a bunch of

2004-05-11 01:34:55 +00:00

parsermodule.c

PEP-0318, @decorator-style. In Guido's words:

2004-08-02 06:10:11 +00:00

posixmodule.c

Return unicode strings from _getfullpathname even on W9X. Fixes #924703 .

2004-06-15 18:49:58 +00:00

puremodule.c

Patch #477750: Use METH_ constants in Modules.

2002-01-17 23:15:58 +00:00

pwdmodule.c

pwd_getpwuid(), pwd_getpwnam(): Patch # 868499, improvement to the error

2004-01-20 21:07:23 +00:00

pyexpat.c

add constants for many error values added over the past couple of

2004-08-04 22:28:16 +00:00

python.c

Apparently FreeBSD enables some HW floating-point exceptions by default.

2002-12-28 21:56:08 +00:00

readline.c

PyThreadState_Swap(NULL) didn't do what I thought it did. Fixes

2004-07-08 15:28:26 +00:00

regexmodule.c

Simplify and speedup uses of Py_BuildValue():

2003-10-12 19:09:37 +00:00

regexpr.c

Replace abort with Py_FatalError.

2002-08-07 16:21:51 +00:00

regexpr.h

Spelling fixes supplied by Rob W. W. Hooft. All these are fixes in either

2000-07-16 12:04:32 +00:00

resource.c

Get build working with pre-C99 compilers

2003-03-30 20:51:29 +00:00

rgbimgmodule.c

Excise DL_EXPORT/DL_IMPORT from Modules/*. Required adding a prototype

2002-08-02 02:27:13 +00:00

rotormodule.c

[Patch #679505] Trigger DeprecationWarning on importing the rotor module

2003-04-24 13:17:13 +00:00

selectmodule.c

[Bug #923315] Produce correct result on AIX

2004-08-07 17:21:27 +00:00

Setup.config.in

Patch to make _codecs a builtin module. This is necessary since

2002-12-12 17:37:50 +00:00

Setup.dist

SF bug #999776, zlib home page wrong

2004-07-29 03:55:56 +00:00

sgimodule.c

Convert more METH_OLDARGS & PyArg_Parse()

2002-04-02 18:26:33 +00:00

shamodule.c

Use personal e-mail address

2002-10-30 21:08:34 +00:00

signalmodule.c

silly typo

2004-06-17 15:55:53 +00:00

socketmodule.c

Restore compilation on MSVC++ 6.0

2004-08-03 08:52:46 +00:00

socketmodule.h

Make socket.sslerror a subclass of socket.error .

2004-03-23 23:16:54 +00:00

sre_constants.h

Implemented non-recursive SRE matching.

2003-10-17 22:13:16 +00:00

sre.h

Add weakref support to sockets and re pattern objects.

2004-05-31 03:09:25 +00:00

stropmodule.c

Patch #774665: Make Python LC_NUMERIC agnostic.

2004-06-08 18:52:54 +00:00

structmodule.c

Getting rid of code dependent on GUSI or the MetroWerks compiler.

2003-11-19 22:52:23 +00:00

sunaudiodev.c

staticforward bites the dust.

2002-07-17 16:30:39 +00:00

svmodule.c

Simplify and speedup uses of Py_BuildValue():

2003-10-12 19:09:37 +00:00

symtablemodule.c

Simplify and speedup uses of Py_BuildValue():

2003-10-12 19:09:37 +00:00

syslogmodule.c

Excise DL_EXPORT/DL_IMPORT from Modules/*. Required adding a prototype

2002-08-02 02:27:13 +00:00

termios.c

Patch #787189: Explicitly define CTRL on SGI.

2003-10-31 13:01:24 +00:00

testcapi_long.h

Fix error in comment, and in test_long_api and test_longlong_api remove

2001-06-16 08:10:13 +00:00

threadmodule.c

Implemented thread-local data as proposed on python-dev:

2004-07-14 19:11:50 +00:00

timemodule.c

allow ctime(), gmtime(), and localtime() to take None as equivalent to an omitted arg

2004-08-03 17:58:55 +00:00

timing.h

…

timingmodule.c

Excise DL_EXPORT/DL_IMPORT from Modules/*. Required adding a prototype

2002-08-02 02:27:13 +00:00

tkappinit.c

Remove warning about implicit declaration of strcmp()

2004-06-13 20:29:55 +00:00

unicodedata_db.h

SF #989185: Drop unicode.iswide() and unicode.width() and add

2004-08-04 07:38:35 +00:00

unicodedata.c

SF #989185: Drop unicode.iswide() and unicode.width() and add

2004-08-04 07:38:35 +00:00

unicodename_db.h

- SF #962502: Add two more methods for unicode type; width() and

2004-06-02 16:49:17 +00:00

xreadlinesmodule.c

Renamed PyObject_GenericGetIter to PyObject_SelfIter

2003-03-17 19:46:11 +00:00

xxmodule.c

Another dummy type.

2003-02-13 18:44:57 +00:00

xxsubtype.c

add some example docstrings using PyDoc_STR

2002-08-14 01:45:37 +00:00

yuv.h

REMOVED all CWI, CNRI and BeOpen copyright markings.

2000-09-01 23:29:29 +00:00

yuvconvert.c

REMOVED all CWI, CNRI and BeOpen copyright markings.

2000-09-01 23:29:29 +00:00

zipimport.c

Patch #801349: 64-bit fix for AMD64 from Gwenole Beauchesne.

2003-09-07 13:36:48 +00:00

zlibmodule.c

- Thanks to Scott David Daniels, a subtle bug in how the zlib

2003-02-03 20:45:52 +00:00