Issue #18025: Fixed a segfault in io.BufferedIOBase.readinto() when raw

stream's read() returns more bytes than requested.

diff --git a/Lib/test/test_io.py b/Lib/test/test_io.py
index 6efd0105611dde2049cff073affba2c8815913ea..9b8920211e32ddfba3ded27ee8b4fb34f3a643e7 100644 (file)
--- a/Lib/test/test_io.py
+++ b/Lib/test/test_io.py
@@ -3019,6 +3019,15 @@ class MiscIOTest(unittest.TestCase):
 class CMiscIOTest(MiscIOTest):
     io = io
 
+    def test_readinto_buffer_overflow(self):
+        # Issue #18025
+        class BadReader(self.io.BufferedIOBase):
+            def read(self, n=-1):
+                return b'x' * 10**6
+        bufio = BadReader()
+        b = bytearray(2)
+        self.assertRaises(ValueError, bufio.readinto, b)
+
 class PyMiscIOTest(MiscIOTest):
     io = pyio
 

diff --git a/Misc/NEWS b/Misc/NEWS
index 41bc85645a5ba0627543f5e7a7c55c1b7f876622..cb1a33a9a6eed654044615a5ecaa439886793f5f 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -24,6 +24,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #18025: Fixed a segfault in io.BufferedIOBase.readinto() when raw
+  stream's read() returns more bytes than requested.
+
 - Issue #18011: base64.b32decode() now raises a binascii.Error if there are
   non-alphabet characters present in the input string to conform a docstring.
   Updated the module documentation.

diff --git a/Modules/_io/bufferedio.c b/Modules/_io/bufferedio.c
index 2b39f66ccf9d4362e9ee33eb72802dbef1405692..7f180a459288a7c6b254f2d8e26eb6faa797319a 100644 (file)
--- a/Modules/_io/bufferedio.c
+++ b/Modules/_io/bufferedio.c
@@ -69,6 +69,14 @@ bufferediobase_readinto(PyObject *self, PyObject *args)
     }
 
     len = Py_SIZE(data);
+    if (len > buf.len) {
+        PyErr_Format(PyExc_ValueError,
+                     "read() returned too much data: "
+                     "%zd bytes requested, %zd returned",
+                     buf.len, len);
+        Py_DECREF(data);
+        goto error;
+    }
     memcpy(buf.buf, PyBytes_AS_STRING(data), len);
 
     PyBuffer_Release(&buf);