Ensure negative offsets cannot be passed to buffer(). When composing

buffers, compute the new buffer size based on the old buffer size.
Fixes SF bug #1034242.

diff --git a/Objects/bufferobject.c b/Objects/bufferobject.c
index e0344d89d61ceb7e0bf9e08dfed095e46aac98b8..674d2b562b6838c8a1e6dcdb11374520d3e3862e 100644 (file)
--- a/Objects/bufferobject.c
+++ b/Objects/bufferobject.c
@@ -90,10 +90,23 @@ buffer_from_memory(PyObject *base, int size, int offset, void *ptr,
 static PyObject *
 buffer_from_object(PyObject *base, int size, int offset, int readonly)
 {
+       if (offset < 0) {
+               PyErr_SetString(PyExc_ValueError,
+                               "offset must be zero or positive");
+               return NULL;
+       }
        if ( PyBuffer_Check(base) && (((PyBufferObject *)base)->b_base) ) {
                /* another buffer, refer to the base object */
-               offset += ((PyBufferObject *)base)->b_offset;
-               base = ((PyBufferObject *)base)->b_base;
+               PyBufferObject *b = (PyBufferObject *)base;
+               if (b->b_size != Py_END_OF_BUFFER) {
+                       int base_size = b->b_size - offset;
+                       if (base_size < 0)
+                               base_size = 0;
+                       if (size == Py_END_OF_BUFFER || size > base_size)
+                               size = base_size;
+               }
+               offset += b->b_offset;
+               base = b->b_base;
        }
        return buffer_from_memory(base, size, offset, NULL, readonly);
 }