python accesses memory before short string when checking suffix
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Python |
Fix Released
|
Unknown
|
|||
python2.5 (Ubuntu) |
Fix Released
|
Low
|
Unassigned | ||
python2.6 (Ubuntu) |
Fix Released
|
Low
|
Unassigned |
Bug Description
Binary package hint: python2.5
Ubuntu 8.04, python 2.5.2-0ubuntu1, python2.5 2.5.2-2ubuntu4.
Python/
starts four characters back from the end. But what if the filename is only one
character long? Memory before the filename is referenced which is probably
outside the memory allocated for the string. Here's the relevant bits of code,
boring lines deleted.
int
PyRun_
{
ext = filename + strlen(filename) - 4;
if (maybe_pyc_file(fp, filename, ext, closeit)) {
if (strcmp(ext, ".pyo") == 0)
}
static int
maybe_
{
if (strcmp(ext, ".pyc") == 0 || strcmp(ext, ".pyo") == 0)
return 1;
}
A trivial solution is:
len = strlen(filename);
ext = filename + len - len > 4 ? 4 : 0;
This will make ext point to the NUL terminator unless filename has room
for the desired /\.py[co]$/ suffix *and* at least one character
beforehand, since I don't suppose it's intended that ".pyo" is a valid
pyo file.
Changed in python2.5: | |
importance: | Undecided → Low |
status: | New → Triaged |
Changed in python: | |
status: | Unknown → New |
Changed in python2.6 (Ubuntu): | |
importance: | Undecided → Low |
status: | New → In Progress |
Changed in python2.5 (Ubuntu): | |
status: | Triaged → In Progress |
Changed in python: | |
status: | New → Fix Released |
This bug was fixed in the package python2.5 - 2.5.4-1ubuntu4
---------------
python2.5 (2.5.4-1ubuntu4) jaunty; urgency=low
* Fix issue #1651995, _convert_ref for non-ASCII characters. LP: #240929. eExFlags avoid invalid memory access formatyearpage( ).
* Fix issue #3845, in PyRun_SimpleFil
with short file names. LP: #234798.
* Fix issue #1046, title endtag in HTMLCalender.
Closes: #513335.
* Py_DECREF: Add `do { ... } while (0)' to avoid compiler warnings.
* curses.initscr(): raise an error instead of calling exit() in error cases.
Closes: #478817.
* Fix comment macro in python manpage.
-- Matthias Klose <email address hidden> Sat, 04 Apr 2009 19:09:56 +0200