Bug 1688393. Adds a control of negative values in

socket.recvfrom, which caused an ugly crash.

diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py
index 5be3dc3b5e17438bd5576329fc741fe1039a9574..24d1a5dd3de294de6b318efbbee297f3a8ce0714 100644 (file)
--- a/Lib/test/test_socket.py
+++ b/Lib/test/test_socket.py
@@ -597,6 +597,13 @@ class BasicUDPTest(ThreadedUDPSocketTest):
     def _testRecvFrom(self):
         self.cli.sendto(MSG, 0, (HOST, PORT))
 
+    def testRecvFromNegative(self):
+        # Negative lengths passed to recvfrom should give ValueError.
+        self.assertRaises(ValueError, self.serv.recvfrom, -1)
+
+    def _testRecvFromNegative(self):
+        self.cli.sendto(MSG, 0, (HOST, PORT))
+
 class TCPCloserTest(ThreadedTCPSocketTest):
 
     def testClose(self):

diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c
index cc54098f6a4de698e3682cc57c99eba673783872..96682ca86d3bbb1f418500f44527bf1c24b927fa 100644 (file)
--- a/Modules/socketmodule.c
+++ b/Modules/socketmodule.c
@@ -2391,7 +2391,7 @@ sock_recv_into(PySocketSockObject *s, PyObject *args, PyObject *kwds)
 
        if (recvlen < 0) {
                PyErr_SetString(PyExc_ValueError,
-                               "negative buffersize in recv");
+                               "negative buffersize in recv_into");
                return NULL;
        }
        if (recvlen == 0) {
@@ -2507,6 +2507,12 @@ sock_recvfrom(PySocketSockObject *s, PyObject *args)
        if (!PyArg_ParseTuple(args, "i|i:recvfrom", &recvlen, &flags))
                return NULL;
 
+       if (recvlen < 0) {
+               PyErr_SetString(PyExc_ValueError,
+                               "negative buffersize in recvfrom");
+               return NULL;
+       }
+
        buf = PyString_FromStringAndSize((char *) 0, recvlen);
        if (buf == NULL)
                return NULL;
@@ -2560,7 +2566,7 @@ sock_recvfrom_into(PySocketSockObject *s, PyObject *args, PyObject* kwds)
 
        if (recvlen < 0) {
                PyErr_SetString(PyExc_ValueError,
-                               "negative buffersize in recv");
+                               "negative buffersize in recvfrom_into");
                return NULL;
        }
        if (recvlen == 0) {