From 763b0d19c94b59b37fa140b8c578f141422e0d25 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Thu, 31 Oct 2013 16:56:38 +0100 Subject: [PATCH] Issue #19437: Fix r_PyLong() of marshal module, stop immediatly at first failure, don't read any more data --- Python/marshal.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/Python/marshal.c b/Python/marshal.c index 4401afb211..411f1e0782 100644 --- a/Python/marshal.c +++ b/Python/marshal.c @@ -612,6 +612,7 @@ r_string(Py_ssize_t n, RFILE *p) } p->buf_size = n; } + if (!p->readable) { assert(p->fp != NULL); read = fread(p->buf, 1, n, p->fp); @@ -731,25 +732,31 @@ r_PyLong(RFILE *p) ob = _PyLong_New(size); if (ob == NULL) return NULL; + Py_SIZE(ob) = n > 0 ? size : -size; for (i = 0; i < size-1; i++) { d = 0; for (j=0; j < PyLong_MARSHAL_RATIO; j++) { md = r_short(p); - if (PyErr_Occurred()) - break; + if (PyErr_Occurred()) { + Py_DECREF(ob); + return NULL; + } if (md < 0 || md > PyLong_MARSHAL_BASE) goto bad_digit; d += (digit)md << j*PyLong_MARSHAL_SHIFT; } ob->ob_digit[i] = d; } + d = 0; for (j=0; j < shorts_in_top_digit; j++) { md = r_short(p); - if (PyErr_Occurred()) - break; + if (PyErr_Occurred()) { + Py_DECREF(ob); + return NULL; + } if (md < 0 || md > PyLong_MARSHAL_BASE) goto bad_digit; /* topmost marshal digit should be nonzero */ -- 2.49.0