When unmarshalling, add test for negative lengths on strings, tuples

and lists; if the size is negative, raise an exception.  Also raise an
exception when an undefined type is found -- all this to increase the
chance that garbage input causes an exception instead of a core dump.

diff --git a/Python/marshal.c b/Python/marshal.c
index 3664734c0a2f6e0fd201bc11a221bdb8c2905c51..3d5f2e5315514b2f59bff92e043a6eb6e9205b97 100644 (file)
--- a/Python/marshal.c
+++ b/Python/marshal.c
@@ -463,6 +463,10 @@ r_object(p)
        
        case TYPE_STRING:
                n = r_long(p);
+               if (n < 0) {
+                       PyErr_SetString(PyExc_ValueError, "bad marshal data");
+                       return NULL;
+               }
                v = PyString_FromStringAndSize((char *)NULL, n);
                if (v != NULL) {
                        if (r_string(PyString_AsString(v), (int)n, p) != n) {
@@ -476,6 +480,10 @@ r_object(p)
        
        case TYPE_TUPLE:
                n = r_long(p);
+               if (n < 0) {
+                       PyErr_SetString(PyExc_ValueError, "bad marshal data");
+                       return NULL;
+               }
                v = PyTuple_New((int)n);
                if (v == NULL)
                        return v;
@@ -492,6 +500,10 @@ r_object(p)
        
        case TYPE_LIST:
                n = r_long(p);
+               if (n < 0) {
+                       PyErr_SetString(PyExc_ValueError, "bad marshal data");
+                       return NULL;
+               }
                v = PyList_New((int)n);
                if (v == NULL)
                        return v;
@@ -571,8 +583,8 @@ r_object(p)
        default:
                /* Bogus data got written, which isn't ideal.
                   This will let you keep working and recover. */
-               Py_INCREF(Py_None);
-               return Py_None;
+               PyErr_SetString(PyExc_ValueError, "bad marshal data");
+               return NULL;
        
        }
 }