bpo-30245: Fix possible overflow when organize struct.pack_into error message (#1682)

diff --git a/Lib/test/test_struct.py b/Lib/test/test_struct.py
index 02d50b2d1c374e2c489b3a29376ff8905f3b1322..b2a5f429e0b94b26a6eedfd677b210ef486e7ff2 100644 (file)
--- a/Lib/test/test_struct.py
+++ b/Lib/test/test_struct.py
@@ -599,6 +599,16 @@ class StructTest(unittest.TestCase):
                 'offset -11 out of range for 10-byte buffer'):
             struct.pack_into('<B', byte_list, -11, 123)
 
+    def test_boundary_error_message_with_large_offset(self):
+        # Test overflows cause by large offset and value size (issue 30245)
+        regex = (
+            r'pack_into requires a buffer of at least ' + str(sys.maxsize + 4) +
+            r' bytes for packing 4 bytes at offset ' + str(sys.maxsize) +
+            r' \(actual buffer size is 10\)'
+        )
+        with self.assertRaisesRegex(struct.error, regex):
+            struct.pack_into('<I', bytearray(10), sys.maxsize, 1)
+
     def test_issue29802(self):
         # When the second argument of struct.unpack() was of wrong type
         # the Struct object was decrefed twice and the reference to

diff --git a/Misc/ACKS b/Misc/ACKS
index bee9eb0e136270d8664763a5da211bec913063e7..6fe57d548beef471e9c83829cf8be9d5260eab82 100644 (file)
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -921,6 +921,7 @@ Gregor Lingl
 Everett Lipman
 Mirko Liss
 Alexander Liu
+Yuan Liu
 Nick Lockwood
 Stephanie Lockwood
 Martin von Löwis

diff --git a/Misc/NEWS b/Misc/NEWS
index ada74a06511962d7da677f2f2a1afa59143e320a..5066f57e143a02e5cf9cabd81fc2da1b06ca75e9 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -345,6 +345,9 @@ Extension Modules
 Library
 -------
 
+- bpo-30245: Fix possible overflow when organize struct.pack_into
+  error message.  Patch by Yuan Liu.
+  
 - bpo-30378: Fix the problem that logging.handlers.SysLogHandler cannot
   handle IPv6 addresses.
 

diff --git a/Modules/_struct.c b/Modules/_struct.c
index 8e1e21986caaf14e86ab6a2cfdadc4cc75141ff2..5b74ec5b4923b3acc05306a2c351c6485e6e00d4 100644 (file)
--- a/Modules/_struct.c
+++ b/Modules/_struct.c
@@ -1929,11 +1929,14 @@ s_pack_into(PyObject *self, PyObject **args, Py_ssize_t nargs, PyObject *kwnames
 
     /* Check boundaries */
     if ((buffer.len - offset) < soself->s_size) {
+        assert(offset >= 0);
+        assert(soself->s_size >= 0);
+
         PyErr_Format(StructError,
-                     "pack_into requires a buffer of at least %zd bytes for "
+                     "pack_into requires a buffer of at least %zu bytes for "
                      "packing %zd bytes at offset %zd "
                      "(actual buffer size is %zd)",
-                     soself->s_size + offset,
+                     (size_t)soself->s_size + (size_t)offset,
                      soself->s_size,
                      offset,
                      buffer.len);