From 28cf368c1baba3db1f01010e921f63017af74c8f Mon Sep 17 00:00:00 2001 From: Benjamin Peterson Date: Mon, 13 Jan 2014 22:59:38 -0500 Subject: [PATCH] complain when nbytes > buflen to fix possible buffer overflow (closes #20246) --- Lib/test/test_socket.py | 10 ++++++++++ Misc/ACKS | 1 + Misc/NEWS | 2 ++ Modules/socketmodule.c | 4 ++++ 4 files changed, 17 insertions(+) diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py index 4a60be3bcb..c7ad1217e4 100644 --- a/Lib/test/test_socket.py +++ b/Lib/test/test_socket.py @@ -1620,6 +1620,16 @@ class BufferIOTest(SocketConnectedTest): _testRecvFromIntoMemoryview = _testRecvFromIntoArray + def testRecvFromIntoSmallBuffer(self): + # See issue #20246. + buf = bytearray(8) + self.assertRaises(ValueError, self.cli_conn.recvfrom_into, buf, 1024) + + def _testRecvFromIntoSmallBuffer(self): + with test_support.check_py3k_warnings(): + buf = buffer(MSG*2048) + self.serv_conn.send(buf) + TIPC_STYPE = 2000 TIPC_LOWER = 200 diff --git a/Misc/ACKS b/Misc/ACKS index 2ea2322b4b..2d778a43c6 100644 --- a/Misc/ACKS +++ b/Misc/ACKS @@ -979,6 +979,7 @@ Eric V. Smith Christopher Smith Gregory P. Smith Roy Smith +Ryan Smith-Roberts Rafal Smotrzyk Dirk Soede Paul Sokolovsky diff --git a/Misc/NEWS b/Misc/NEWS index 6eee65c9a3..17e61fdf68 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -35,6 +35,8 @@ Core and Builtins Library ------- +- Issue #20246: Fix buffer overflow in socket.recvfrom_into. + - Issue #19082: Working SimpleXMLRPCServer and xmlrpclib examples, both in modules and documentation. diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c index 2735ecc773..27df333b7a 100644 --- a/Modules/socketmodule.c +++ b/Modules/socketmodule.c @@ -2742,6 +2742,10 @@ sock_recvfrom_into(PySocketSockObject *s, PyObject *args, PyObject* kwds) if (recvlen == 0) { /* If nbytes was not specified, use the buffer's length */ recvlen = buflen; + } else if (recvlen > buflen) { + PyErr_SetString(PyExc_ValueError, + "nbytes is greater than the length of the buffer"); + goto error; } readlen = sock_recvfrom_guts(s, buf.buf, recvlen, flags, &addr); -- 2.50.1