From: Gregory P. Smith <greg@mad-scientist.com>
Date: Wed, 9 Apr 2008 00:26:44 +0000 (+0000)
Subject: Merge r62235 from trunk.
X-Git-Tag: v2.5.3c1~110
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f62346775911d56b5440ec7fd699b749f5106436;p=python

Merge r62235 from trunk.

Fix zlib crash from zlib.decompressobj().flush(val) when val was not positive.
It tried to allocate negative or zero memory.  That fails.
---

diff --git a/Lib/test/test_zlib.py b/Lib/test/test_zlib.py
index 4440942ac9..6b3b12eccc 100644
--- a/Lib/test/test_zlib.py
+++ b/Lib/test/test_zlib.py
@@ -71,6 +71,11 @@ class ExceptionTestCase(unittest.TestCase):
         # verify failure on building decompress object with bad params
         self.assertRaises(ValueError, zlib.decompressobj, 0)
 
+    def test_decompressobj_badflush(self):
+        # verify failure on calling decompressobj.flush with bad params
+        self.assertRaises(ValueError, zlib.decompressobj().flush, 0)
+        self.assertRaises(ValueError, zlib.decompressobj().flush, -1)
+
 
 
 class CompressTestCase(unittest.TestCase):
diff --git a/Modules/zlibmodule.c b/Modules/zlibmodule.c
index 8cadcbc52c..aff165c361 100644
--- a/Modules/zlibmodule.c
+++ b/Modules/zlibmodule.c
@@ -774,6 +774,10 @@ PyZlib_unflush(compobject *self, PyObject *args)
 
     if (!PyArg_ParseTuple(args, "|i:flush", &length))
 	return NULL;
+    if (length <= 0) {
+	PyErr_SetString(PyExc_ValueError, "length must be greater than zero");
+	return NULL;
+    }
     if (!(retval = PyString_FromStringAndSize(NULL, length)))
 	return NULL;