Reported by Thomas E. Hybel
Library
-------
+- Issue #27758: Fix possible integer overflow in the _csv module for large record
+ lengths.
+
- Issue #23369: Fixed possible integer overflow in
_json.encode_basestring_ascii.
int i, rec_len;
char *lineterm;
-#define ADDCH(c) \
+#define INCLEN \
+ do {\
+ if (!copy_phase && rec_len == INT_MAX) { \
+ goto overflow; \
+ } \
+ rec_len++; \
+ } while(0)
+
+#define ADDCH(c) \
do {\
if (copy_phase) \
self->rec[rec_len] = c;\
- rec_len++;\
+ INCLEN;\
} while(0)
lineterm = PyString_AsString(dialect->lineterminator);
if (*quoted) {
if (copy_phase)
ADDCH(dialect->quotechar);
- else
- rec_len += 2;
+ else {
+ INCLEN; /* starting quote */
+ INCLEN; /* ending quote */
+ }
}
return rec_len;
+
+ overflow:
+ PyErr_NoMemory();
+ return -1;
#undef ADDCH
+#undef INCLEN
}
static int