[issue8651] "s#" and friends can silently truncate buffer length

STINNER Victor added the comment: > Reopen the issue if you would like a port to 2.7 > (I am too lazy to do it) I backported the fix to help issue #11277. While backporting the fix, I found another bug fixed by 509f1c15a1e1. -- ___ Python tracker

[issue8651] "s#" and friends can silently truncate buffer length

Roundup Robot added the comment: New changeset a0681e7a6ded by Victor Stinner in branch '2.7': Issue #8651: PyArg_Parse*() functions raise an OverflowError if the file http://hg.python.org/cpython/rev/a0681e7a6ded -- ___ Python tracker

[issue8651] "s#" and friends can silently truncate buffer length

Roundup Robot added the comment: New changeset 509f1c15a1e1 by Victor Stinner in branch '2.7': Issue #8651: Fix "z#" format of PyArg_Parse*() function: the size was not http://hg.python.org/cpython/rev/509f1c15a1e1 -- ___ Python tracker

[issue8651] "s#" and friends can silently truncate buffer length

STINNER Victor added the comment: Ok, I backported the fix to 3.1. Reopen the issue if you would like a port to 2.7 (I am too lazy to do it). -- resolution: -> fixed status: open -> closed ___ Python tracker

[issue8651] "s#" and friends can silently truncate buffer length

Roundup Robot added the comment: New changeset d9633064458c by Victor Stinner in branch '3.1': Issue #8651: PyArg_Parse*() functions raise an OverflowError if the file http://hg.python.org/cpython/rev/d9633064458c -- nosy: +python-dev ___ Python trac

[issue8651] "s#" and friends can silently truncate buffer length

STINNER Victor added the comment: I removed Antoine's message because it was related to issue #8650. -- ___ Python tracker ___ ___ Pyt

[issue8651] "s#" and friends can silently truncate buffer length

Changes by STINNER Victor : -- Removed message: http://bugs.python.org/msg128976 ___ Python tracker ___ ___ Python-bugs-list mailing li

[issue8651] "s#" and friends can silently truncate buffer length

Changes by Nadeem Vawda : -- nosy: +nvawda ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.or

[issue8651] "s#" and friends can silently truncate buffer length

Antoine Pitrou added the comment: > Fixed by r87728. This only addresses the compress() and decompress() functions, but e.g. crc32() and adler32() are also touched by this issue. -- ___ Python tracker ___

[issue8651] "s#" and friends can silently truncate buffer length

STINNER Victor added the comment: Fixed by r87728. Wait for the buildbots before backporting to other versions. -- ___ Python tracker ___ ___

[issue8651] "s#" and friends can silently truncate buffer length

Antoine Pitrou added the comment: Could you add a proper unit test? -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubs

[issue8651] "s#" and friends can silently truncate buffer length

Changes by Ryan Coyner : -- nosy: +rcoyner ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.or

[issue8651] "s#" and friends can silently truncate buffer length

STINNER Victor added the comment: Another test (only requires ~2 GB of memory, not 4 GB or more) for the patch: import _elementtree def test(): parser=_elementtree.XMLParser() text='s' * (2**31 + 10) try: parser.feed(text) except OverflowError as err: print("ok:

[issue8651] "s#" and friends can silently truncate buffer length

STINNER Victor added the comment: getarg.patch fixes STORE_SIZE macro used in convertsimple(). If the input size is bigger than INT_MAX, it raises an OverflowError("size does not fit in an int") and calls converterr() which expected="". The value of expected is useless because converterr() is

[issue8651] "s#" and friends can silently truncate buffer length

New submission from Antoine Pitrou : When PY_SSIZE_T isn't defined and a format such as "s#" receives an object whose length fits in a Py_ssize_t but not in an int, the buffer length is silently truncated: >>> s = 'x' * (4 * 1024**3 + 100) >>> t = zlib.compress(s, 1) >>> len(t) 12 >>> len(zlib