From f62346775911d56b5440ec7fd699b749f5106436 Mon Sep 17 00:00:00 2001 From: "Gregory P. Smith" Date: Wed, 9 Apr 2008 00:26:44 +0000 Subject: [PATCH] Merge r62235 from trunk. Fix zlib crash from zlib.decompressobj().flush(val) when val was not positive. It tried to allocate negative or zero memory. That fails. --- Lib/test/test_zlib.py | 5 +++++ Modules/zlibmodule.c | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/Lib/test/test_zlib.py b/Lib/test/test_zlib.py index 4440942ac9..6b3b12eccc 100644 --- a/Lib/test/test_zlib.py +++ b/Lib/test/test_zlib.py @@ -71,6 +71,11 @@ class ExceptionTestCase(unittest.TestCase): # verify failure on building decompress object with bad params self.assertRaises(ValueError, zlib.decompressobj, 0) + def test_decompressobj_badflush(self): + # verify failure on calling decompressobj.flush with bad params + self.assertRaises(ValueError, zlib.decompressobj().flush, 0) + self.assertRaises(ValueError, zlib.decompressobj().flush, -1) + class CompressTestCase(unittest.TestCase): diff --git a/Modules/zlibmodule.c b/Modules/zlibmodule.c index 8cadcbc52c..aff165c361 100644 --- a/Modules/zlibmodule.c +++ b/Modules/zlibmodule.c @@ -774,6 +774,10 @@ PyZlib_unflush(compobject *self, PyObject *args) if (!PyArg_ParseTuple(args, "|i:flush", &length)) return NULL; + if (length <= 0) { + PyErr_SetString(PyExc_ValueError, "length must be greater than zero"); + return NULL; + } if (!(retval = PyString_FromStringAndSize(NULL, length))) return NULL; -- 2.50.1