djsundog
/
circuitpython
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

py/objstr: Protect against creating bytes(n) with n negative. 

Prior to this patch uPy (on a 32-bit arch) would have severe issues when
calling bytes(-1): such a call would call vstr_init_len(vstr, -1) which
would then +1 on the len and call vstr_init(vstr, 0), which would then
round this up and allocate a small amount of memory for the vstr.  The
bytes constructor would then attempt to zero out all this memory, thinking
it had allocated 2^32-1 bytes.
This commit is contained in:
Damien George 2018-02-19 16:25:30 +11:00
parent 165aab12a3
commit 4e469085c1
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
py/objstr.c
View File

@ -223,7 +223,10 @@ STATIC mp_obj_t bytes_make_new(const mp_obj_type_t *type_in, size_t n_args, size
} }
if (MP_OBJ_IS_SMALL_INT(args[0])) { if (MP_OBJ_IS_SMALL_INT(args[0])) {
uint len = MP_OBJ_SMALL_INT_VALUE(args[0]); mp_int_t len = MP_OBJ_SMALL_INT_VALUE(args[0]);
if (len < 0) {
mp_raise_ValueError(NULL);
}
vstr_t vstr; vstr_t vstr;
vstr_init_len(&vstr, len); vstr_init_len(&vstr, len);
memset(vstr.buf, 0, len); memset(vstr.buf, 0, len);

6
tests/basics/bytes.py
View File

@ -56,3 +56,9 @@ print(x[0], x[1], x[2], x[3])
print(bytes([128, 255])) print(bytes([128, 255]))
# For sequence of unknown len # For sequence of unknown len
print(bytes(iter([128, 255]))) print(bytes(iter([128, 255])))
# Shouldn't be able to make bytes with negative length
try:
bytes(-1)
except ValueError:
print('ValueError')