From: Oren Milman <orenmn@gmail.com>
Date: Sat, 26 Aug 2017 18:56:31 +0000 (+0300)
Subject: [2.7] bpo-28261: Prevent raising SystemError where PyArg_ParseTuple is used to parse... 
X-Git-Tag: v2.7.15rc1~239
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bc80fd1bd2e8b6817accbc101e7fe5e50ba8f768;p=python

[2.7] bpo-28261: Prevent raising SystemError where PyArg_ParseTuple is used to parse non-args. (#3213)
---

diff --git a/Lib/test/test_audioop.py b/Lib/test/test_audioop.py
index 4af73500ea..5f1deb5776 100644
--- a/Lib/test/test_audioop.py
+++ b/Lib/test/test_audioop.py
@@ -325,6 +325,10 @@ class TestAudioop(unittest.TestCase):
             self.assertEqual(audioop.ratecv(datas[w], w, 1, 8000, 8000, None, 30, 10)[0],
                              expected[w])
 
+        self.assertRaises(TypeError, audioop.ratecv, b'', 1, 1, 8000, 8000, 42)
+        self.assertRaises(TypeError, audioop.ratecv,
+                          b'', 1, 1, 8000, 8000, (1, (42,)))
+
     def test_reverse(self):
         for w in 1, 2, 4:
             self.assertEqual(audioop.reverse(b'', w), b'')
diff --git a/Modules/audioop.c b/Modules/audioop.c
index a4d13753b6..ad7336c7f9 100644
--- a/Modules/audioop.c
+++ b/Modules/audioop.c
@@ -1086,7 +1086,7 @@ audioop_ratecv(PyObject *self, PyObject *args)
     char *cp, *ncp;
     int len, size, nchannels, inrate, outrate, weightA, weightB;
     int chan, d, *prev_i, *cur_i, cur_o;
-    PyObject *state, *samps, *str, *rv = NULL;
+    PyObject *state, *samps, *str, *rv = NULL, *channel;
     int bytes_per_frame;
 
     weightA = 1;
@@ -1152,6 +1152,10 @@ audioop_ratecv(PyObject *self, PyObject *args)
             prev_i[chan] = cur_i[chan] = 0;
     }
     else {
+        if (!PyTuple_Check(state)) {
+            PyErr_SetString(PyExc_TypeError, "state must be a tuple or None");
+            goto exit;
+        }
         if (!PyArg_ParseTuple(state,
                         "iO!;audioop.ratecv: illegal state argument",
                         &d, &PyTuple_Type, &samps))
@@ -1162,7 +1166,13 @@ audioop_ratecv(PyObject *self, PyObject *args)
             goto exit;
         }
         for (chan = 0; chan < nchannels; chan++) {
-            if (!PyArg_ParseTuple(PyTuple_GetItem(samps, chan),
+            channel = PyTuple_GetItem(samps, chan);
+            if (!PyTuple_Check(channel)) {
+                PyErr_SetString(PyExc_TypeError,
+                                "ratecv(): illegal state argument");
+                goto exit;
+            }
+            if (!PyArg_ParseTuple(channel,
                                   "ii:ratecv", &prev_i[chan],
                                                &cur_i[chan]))
                 goto exit;