From: Facundo Batista <facundobatista@gmail.com>
Date: Wed, 28 Mar 2007 03:45:20 +0000 (+0000)
Subject: Bug 1688393. Adds a control of negative values in
X-Git-Tag: v2.6a1~1922
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1fe9f968a21843175c3cbd6adf632aa95d2f2bef;p=python

Bug 1688393. Adds a control of negative values in
socket.recvfrom, which caused an ugly crash.
---

diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py
index 5be3dc3b5e..24d1a5dd3d 100644
--- a/Lib/test/test_socket.py
+++ b/Lib/test/test_socket.py
@@ -597,6 +597,13 @@ class BasicUDPTest(ThreadedUDPSocketTest):
     def _testRecvFrom(self):
         self.cli.sendto(MSG, 0, (HOST, PORT))
 
+    def testRecvFromNegative(self):
+        # Negative lengths passed to recvfrom should give ValueError.
+        self.assertRaises(ValueError, self.serv.recvfrom, -1)
+
+    def _testRecvFromNegative(self):
+        self.cli.sendto(MSG, 0, (HOST, PORT))
+
 class TCPCloserTest(ThreadedTCPSocketTest):
 
     def testClose(self):
diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c
index cc54098f6a..96682ca86d 100644
--- a/Modules/socketmodule.c
+++ b/Modules/socketmodule.c
@@ -2391,7 +2391,7 @@ sock_recv_into(PySocketSockObject *s, PyObject *args, PyObject *kwds)
 
 	if (recvlen < 0) {
 		PyErr_SetString(PyExc_ValueError,
-				"negative buffersize in recv");
+				"negative buffersize in recv_into");
 		return NULL;
 	}
 	if (recvlen == 0) {
@@ -2507,6 +2507,12 @@ sock_recvfrom(PySocketSockObject *s, PyObject *args)
 	if (!PyArg_ParseTuple(args, "i|i:recvfrom", &recvlen, &flags))
 		return NULL;
 
+	if (recvlen < 0) {
+		PyErr_SetString(PyExc_ValueError,
+				"negative buffersize in recvfrom");
+		return NULL;
+	}
+
 	buf = PyString_FromStringAndSize((char *) 0, recvlen);
 	if (buf == NULL)
 		return NULL;
@@ -2560,7 +2566,7 @@ sock_recvfrom_into(PySocketSockObject *s, PyObject *args, PyObject* kwds)
 
 	if (recvlen < 0) {
 		PyErr_SetString(PyExc_ValueError,
-				"negative buffersize in recv");
+				"negative buffersize in recvfrom_into");
 		return NULL;
 	}
 	if (recvlen == 0) {