#6553: crash in cPickle.load(), when given a StringIO with incomplete data.

Will backport to 2.6, 3.x already fixed a similar issue with issue4298.

diff --git a/Lib/test/pickletester.py b/Lib/test/pickletester.py
index 7306aa807a8db57a2cf5a77bbf56d1addc8fadd3..8f96d74271cadb8f2965c5ecb81e8c42c390ef4e 100644 (file)
--- a/Lib/test/pickletester.py
+++ b/Lib/test/pickletester.py
@@ -1,6 +1,7 @@
 import unittest
 import pickle
 import cPickle
+import StringIO
 import cStringIO
 import pickletools
 import copy_reg
@@ -1086,6 +1087,10 @@ class AbstractPickleModuleTests(unittest.TestCase):
         self.module.Pickler(f, -1)
         self.module.Pickler(f, protocol=-1)
 
+    def test_incomplete_input(self):
+        s = StringIO.StringIO("X''.")
+        self.assertRaises(EOFError, self.module.load, s)
+
 class AbstractPersistentPicklerTests(unittest.TestCase):
 
     # This class defines persistent_id() and persistent_load()

diff --git a/Misc/NEWS b/Misc/NEWS
index f04956cba18870ff72bf7c91f6692a28b3267cd7..b6ccc092070794072d16137ea692edb9253fc4ea 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -351,7 +351,10 @@ Core and Builtins
 Library
 -------
 
-- Issue #6545: Removed assert statements in distutils.Extension, so the 
+- Issue #6553: Fixed a crash in cPickle.load(), when given a file-like object
+  containing incomplete data.
+
+- Issue #6545: Removed assert statements in distutils.Extension, so the
   behavior is similar when used with -O.
 
 - unittest has been split up into a package.  All old names should still work.
@@ -360,7 +363,7 @@ Library
   know how to handle a comparison without loss of precision.  Also add
   correct handling of infinities and nans for comparisons with float.
 
-- Issue #6415: Fixed warnings.warn sagfault on bad formatted string.
+- Issue #6415: Fixed warnings.warn segfault on bad formatted string.
 
 - Issue #6466: now distutils.cygwinccompiler and distutils.emxccompiler
   uses the same refactored function to get gcc/ld/dllwrap versions numbers.

diff --git a/Modules/cPickle.c b/Modules/cPickle.c
index 486e86fc125484227b9d24fa9e8895424c1d3591..a84942403bc7055f8d5c242e2315874cfd60c886 100644 (file)
--- a/Modules/cPickle.c
+++ b/Modules/cPickle.c
@@ -663,6 +663,12 @@ read_other(Unpicklerobject *self, char **s, Py_ssize_t  n)
        self->last_string = str;
 
        if (! (*s = PyString_AsString(str))) return -1;
+
+       if (PyString_GET_SIZE(str) != n) {
+               PyErr_SetNone(PyExc_EOFError);
+               return -1;
+       }
+
        return n;
 }