Prevent access outside buffer (GH-26012)

sweeneyde · web-flow · commit 45862f9f5ef5 · 2021-05-10T10:10:22.000+01:00
diff --git a/Python/ceval.c b/Python/ceval.c
@@ -4794,8 +4794,10 @@ scan_back_to_entry_start(unsigned char *p) {
 }
 
 static inline unsigned char *
-skip_to_next_entry(unsigned char *p) {
-    for (; (p[0]&128) == 0; p++);
+skip_to_next_entry(unsigned char *p, unsigned char *end) {
+    while (p < end && ((p[0] & 128) == 0)) {
+        p++;
+    }
     return p;
 }
 
@@ -4863,7 +4865,7 @@ get_exception_handler(PyCodeObject *code, int index)
             parse_block(scan, &res);
             return res;
         }
-        scan = skip_to_next_entry(scan);
+        scan = skip_to_next_entry(scan, end);
     }
     res.b_handler = -1;
     return res;

Original file line number	Diff line number	Diff line change
`@@ -4794,8 +4794,10 @@ scan_back_to_entry_start(unsigned char *p) {`
`4794`	`4794`	`}`
`4795`	`4795`
`4796`	`4796`	`static inline unsigned char *`
`4797`		`-skip_to_next_entry(unsigned char *p) {`
`4798`		`- for (; (p[0]&128) == 0; p++);`
	`4797`	`+skip_to_next_entry(unsigned char p, unsigned char end) {`
	`4798`	`+ while (p < end && ((p[0] & 128) == 0)) {`
	`4799`	`+ p++;`
	`4800`	`+ }`
`4799`	`4801`	`return p;`
`4800`	`4802`	`}`
`4801`	`4803`
`@@ -4863,7 +4865,7 @@ get_exception_handler(PyCodeObject *code, int index)`
`4863`	`4865`	`parse_block(scan, &res);`
`4864`	`4866`	`return res;`
`4865`	`4867`	`}`
`4866`		`- scan = skip_to_next_entry(scan);`
	`4868`	`+ scan = skip_to_next_entry(scan, end);`
`4867`	`4869`	`}`
`4868`	`4870`	`res.b_handler = -1;`
`4869`	`4871`	`return res;`