avoid overflow with large buffer sizes and/or offsets (closes #21831)

diff --git a/Lib/test/test_buffer.py b/Lib/test/test_buffer.py
index ac8e636ba4011f7355075e562fe6065c4c06bbcb..a02c5f7e36feba7343aef461212a4294da9b0c60 100644 (file)
--- a/Lib/test/test_buffer.py
+++ b/Lib/test/test_buffer.py
@@ -4,6 +4,7 @@ For now, tests just new or changed functionality.
 
 """
 
+import sys
 import unittest
 from test import test_support
 
@@ -29,6 +30,11 @@ class BufferTests(unittest.TestCase):
         m = memoryview(b) # Should not raise an exception
         self.assertEqual(m.tobytes(), s)
 
+    def test_large_buffer_size_and_offset(self):
+        data = bytearray('hola mundo')
+        buf = buffer(data, sys.maxsize, sys.maxsize)
+        self.assertEqual(buf[:4096], "")
+
 
 def test_main():
     with test_support.check_py3k_warnings(("buffer.. not supported",

diff --git a/Misc/NEWS b/Misc/NEWS
index 3238d06ec74c3725ed361b3e49816b5fc5d630a4..a077b4d6da2165f1ae151f7f9882d411a64aaf94 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 2.7.8?
 Core and Builtins
 -----------------
 
+- Issue #21831: Avoid integer overflow when large sizes and offsets are given to
+  the buffer type.
+
 - Issue #1856: Avoid crashes and lockups when daemon threads run while the
   interpreter is shutting down; instead, these threads are now killed when they
   try to take the GIL.

diff --git a/Objects/bufferobject.c b/Objects/bufferobject.c
index 23b97b23d950f9c96a8ef4ca3265076ea569d7dc..bcfab71787e322f6d6db824ac91161381ec1d39b 100644 (file)
--- a/Objects/bufferobject.c
+++ b/Objects/bufferobject.c
@@ -88,7 +88,7 @@ get_buf(PyBufferObject *self, void **ptr, Py_ssize_t *size,
             *size = count;
         else
             *size = self->b_size;
-        if (offset + *size > count)
+        if (*size > count - offset)
             *size = count - offset;
     }
     return 1;
@@ -875,4 +875,4 @@ PyTypeObject PyBuffer_Type = {
     0,                                          /* tp_init */
     0,                                          /* tp_alloc */
     buffer_new,                                 /* tp_new */
-};
\ No newline at end of file
+};