Issue #17710: Fix pickle raising a SystemError on bogus input.

diff --git a/Lib/pickle.py b/Lib/pickle.py
index e81a3790c3df69a245d796b1b967c9633541ce42..161c2e9e74b9b445f9471eee6e2b5a2ad68856d4 100644 (file)
--- a/Lib/pickle.py
+++ b/Lib/pickle.py
@@ -951,7 +951,7 @@ class _Unpickler:
         rep = orig[:-1]
         for q in (b'"', b"'"): # double or single quote
             if rep.startswith(q):
-                if not rep.endswith(q):
+                if len(rep) < 2 or not rep.endswith(q):
                     raise ValueError("insecure string pickle")
                 rep = rep[len(q):-len(q)]
                 break

diff --git a/Lib/test/pickletester.py b/Lib/test/pickletester.py
index 5d12375267b00796486c70afa6d9ed4044f44799..a72ab377c010dc957bc552a238fec0e35c9ddd5c 100644 (file)
--- a/Lib/test/pickletester.py
+++ b/Lib/test/pickletester.py
@@ -609,6 +609,14 @@ class AbstractPickleTests(unittest.TestCase):
                     b"'abc\"", # open quote and close quote don't match
                     b"'abc'   ?", # junk after close quote
                     b"'\\'", # trailing backslash
+                    # Variations on issue #17710
+                    b"'",
+                    b'"',
+                    b"' ",
+                    b"'  ",
+                    b"'   ",
+                    b"'    ",
+                    b'"    ',
                     # some tests of the quoting rules
                     ## b"'abc\"\''",
                     ## b"'\\\\a\'\'\'\\\'\\\\\''",

diff --git a/Misc/NEWS b/Misc/NEWS
index ade041e96558b6ce27de0261e0d60669deaf9087..bf64dfdea0d57d0faa2a11cafd40b66b39b195ac 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -29,6 +29,8 @@ Core and Builtins
 Library
 -------
 
+- Issue #17710: Fix pickle raising a SystemError on bogus input.
+
 - Issue #17341: Include the invalid name in the error messages from re about
   invalid group names.
 

diff --git a/Modules/_pickle.c b/Modules/_pickle.c
index d0cebd0b17317a746545db4b524ad0a2321c27b4..5564803b88ff8b83c4d248e519f49839be2acbaa 100644 (file)
--- a/Modules/_pickle.c
+++ b/Modules/_pickle.c
@@ -4171,7 +4171,7 @@ load_string(UnpicklerObject *self)
 
     if ((len = _Unpickler_Readline(self, &s)) < 0)
         return -1;
-    if (len < 3)
+    if (len < 2)
         return bad_readline();
     if ((s = strdup(s)) == NULL) {
         PyErr_NoMemory();
@@ -4179,14 +4179,14 @@ load_string(UnpicklerObject *self)
     }
 
     /* Strip outermost quotes */
-    while (s[len - 1] <= ' ')
+    while (len > 0 && s[len - 1] <= ' ')
         len--;
-    if (s[0] == '"' && s[len - 1] == '"') {
+    if (len > 1 && s[0] == '"' && s[len - 1] == '"') {
         s[len - 1] = '\0';
         p = s + 1;
         len -= 2;
     }
-    else if (s[0] == '\'' && s[len - 1] == '\'') {
+    else if (len > 1 && s[0] == '\'' && s[len - 1] == '\'') {
         s[len - 1] = '\0';
         p = s + 1;
         len -= 2;