From: Benjamin Peterson Date: Sun, 30 Mar 2014 23:52:22 +0000 (-0400) Subject: merge 3.2 X-Git-Tag: v3.4.1rc1~153^2 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0ad6098b67acd0b00754e0b6668cb93213cb32d2;p=python merge 3.2 --- 0ad6098b67acd0b00754e0b6668cb93213cb32d2 diff --cc Objects/stringlib/transmogrify.h index 90fa129b32,be595a62ef..cbd7144b0e --- a/Objects/stringlib/transmogrify.h +++ b/Objects/stringlib/transmogrify.h @@@ -15,13 -15,13 +15,13 @@@ stringlib_expandtabs(PyObject *self, Py { const char *e, *p; char *q; - size_t i, j; + Py_ssize_t i, j; PyObject *u; int tabsize = 8; - + if (!PyArg_ParseTuple(args, "|i:expandtabs", &tabsize)) return NULL; - + /* First pass: determine size of output string */ i = j = 0; e = STRINGLIB_STR(self) + STRINGLIB_LEN(self); @@@ -37,32 -35,30 +35,30 @@@ } } else { + if (j > PY_SSIZE_T_MAX - 1) + goto overflow; j++; if (*p == '\n' || *p == '\r') { + if (i > PY_SSIZE_T_MAX - j) + goto overflow; i += j; j = 0; - if (i > PY_SSIZE_T_MAX) { - PyErr_SetString(PyExc_OverflowError, - "result is too long"); - return NULL; - } } } - - if ((i + j) > PY_SSIZE_T_MAX) { - PyErr_SetString(PyExc_OverflowError, "result is too long"); - return NULL; } - + + if (i > PY_SSIZE_T_MAX - j) + goto overflow; - ++ /* Second pass: create output string and fill it */ u = STRINGLIB_NEW(NULL, i + j); if (!u) return NULL; - + j = 0; q = STRINGLIB_STR(u); - - for (p = STRINGLIB_STR(self); p < e; p++) + + for (p = STRINGLIB_STR(self); p < e; p++) { if (*p == '\t') { if (tabsize > 0) { i = tabsize - (j % tabsize);