Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a85998a

Browse files
avassalottiavassalotti
committed
Issue #1950: Fixed misusage of PyUnicode_AsString().
1 parent 999679a commit a85998a

6 files changed

Lines changed: 48 additions & 33 deletions

File tree

‎Modules/datetimemodule.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1217,10 +1217,9 @@ wrap_strftime(PyObject *object, PyObject *format, PyObject *timetuple,
12171217
assert(object && format && timetuple);
12181218
assert(PyUnicode_Check(format));
12191219
/* Convert the input format to a C string and size */
1220-
pin = PyUnicode_AsString(format);
1220+
pin = PyUnicode_AsStringAndSize(format, &flen);
12211221
if (!pin)
12221222
return NULL;
1223-
flen = PyUnicode_GetSize(format);
12241223

12251224
/* Give up if the year is before 1900.
12261225
* Python strftime() plays games with the year, and different

‎Modules/parsermodule.c‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -717,11 +717,10 @@ build_node_children(PyObject *tuple, node *root, int *line_num)
717717
Py_DECREF(o);
718718
}
719719
}
720-
temp_str = PyUnicode_AsString(temp);
721-
len = PyUnicode_GET_SIZE(temp) + 1;
722-
strn = (char *)PyObject_MALLOC(len);
720+
temp_str = PyUnicode_AsStringAndSize(temp, &len);
721+
strn = (char *)PyObject_MALLOC(len + 1);
723722
if (strn != NULL)
724-
(void) memcpy(strn, temp_str, len);
723+
(void) memcpy(strn, temp_str, len + 1);
725724
Py_DECREF(temp);
726725
}
727726
else if (!ISNONTERMINAL(type)) {
@@ -807,11 +806,10 @@ build_node_tree(PyObject *tuple)
807806
if (res && encoding) {
808807
Py_ssize_t len;
809808
const char *temp;
810-
temp = PyUnicode_AsString(encoding);
811-
len = PyUnicode_GET_SIZE(encoding) + 1;
812-
res->n_str = (char *)PyObject_MALLOC(len);
809+
temp = PyUnicode_AsStringAndSize(encoding, &len);
810+
res->n_str = (char *)PyObject_MALLOC(len + 1);
813811
if (res->n_str != NULL && temp != NULL)
814-
(void) memcpy(res->n_str, temp, len);
812+
(void) memcpy(res->n_str, temp, len + 1);
815813
Py_DECREF(encoding);
816814
Py_DECREF(tuple);
817815
}

‎Modules/zipimport.c‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -61,16 +61,14 @@ static int
6161
zipimporter_init(ZipImporter *self, PyObject *args, PyObject *kwds)
6262
{
6363
char *path, *p, *prefix, buf[MAXPATHLEN+2];
64-
size_t len;
64+
Py_ssize_t len;
6565

6666
if (!_PyArg_NoKeywords("zipimporter()", kwds))
6767
return -1;
6868

69-
if (!PyArg_ParseTuple(args, "s:zipimporter",
70-
&path))
69+
if (!PyArg_ParseTuple(args, "s#:zipimporter", &path, &len))
7170
return -1;
7271

73-
len = strlen(path);
7472
if (len == 0) {
7573
PyErr_SetString(ZipImportError, "archive path is empty");
7674
return -1;
@@ -329,7 +327,7 @@ zipimporter_load_module(PyObject *obj, PyObject *args)
329327
fullpath = PyUnicode_FromFormat("%s%c%s%s",
330328
PyUnicode_AsString(self->archive),
331329
SEP,
332-
*prefix ? prefix : "",
330+
prefix ? prefix : "",
333331
subname);
334332
if (fullpath == NULL)
335333
goto error;
@@ -388,6 +386,7 @@ zipimporter_get_data(PyObject *obj, PyObject *args)
388386
#endif
389387
PyObject *toc_entry;
390388
Py_ssize_t len;
389+
char *archive_str;
391390

392391
if (!PyArg_ParseTuple(args, "s:zipimporter.get_data", &path))
393392
return NULL;
@@ -404,9 +403,9 @@ zipimporter_get_data(PyObject *obj, PyObject *args)
404403
}
405404
path = buf;
406405
#endif
407-
len = PyUnicode_GET_SIZE(self->archive);
406+
archive_str = PyUnicode_AsStringAndSize(self->archive, &len);
408407
if ((size_t)len < strlen(path) &&
409-
strncmp(path, PyUnicode_AsString(self->archive), len) == 0 &&
408+
strncmp(path, archive_str, len) == 0 &&
410409
path[len] == SEP) {
411410
path = path + len + 1;
412411
}
@@ -416,7 +415,7 @@ zipimporter_get_data(PyObject *obj, PyObject *args)
416415
PyErr_SetFromErrnoWithFilename(PyExc_IOError, path);
417416
return NULL;
418417
}
419-
return get_data(PyUnicode_AsString(self->archive), toc_entry);
418+
return get_data(archive_str, toc_entry);
420419
}
421420

422421
static PyObject *

‎Objects/typeobject.c‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1255,7 +1255,7 @@ check_duplicates(PyObject *list)
12551255
if (PyList_GET_ITEM(list, j) == o) {
12561256
o = class_name(o);
12571257
PyErr_Format(PyExc_TypeError,
1258-
"duplicate base class %s",
1258+
"duplicate base class %.400s",
12591259
o ? PyUnicode_AsString(o) : "?");
12601260
Py_XDECREF(o);
12611261
return -1;
@@ -2133,20 +2133,27 @@ type_new(PyTypeObject *metatype, PyObject *args, PyObject *kwds)
21332133
{
21342134
PyObject *doc = PyDict_GetItemString(dict, "__doc__");
21352135
if (doc != NULL && PyUnicode_Check(doc)) {
2136-
size_t n;
2136+
Py_ssize_t len;
2137+
char *doc_str;
21372138
char *tp_doc;
2138-
const char *str = PyUnicode_AsString(doc);
2139-
if (str == NULL) {
2139+
2140+
doc_str = PyUnicode_AsStringAndSize(doc, &len);
2141+
if (doc_str == NULL) {
2142+
Py_DECREF(type);
2143+
return NULL;
2144+
}
2145+
if ((Py_ssize_t)strlen(doc_str) != len) {
2146+
PyErr_SetString(PyExc_TypeError,
2147+
"__doc__ contains null-bytes");
21402148
Py_DECREF(type);
21412149
return NULL;
21422150
}
2143-
n = strlen(str);
2144-
tp_doc = (char *)PyObject_MALLOC(n+1);
2151+
tp_doc = (char *)PyObject_MALLOC(len + 1);
21452152
if (tp_doc == NULL) {
21462153
Py_DECREF(type);
21472154
return NULL;
21482155
}
2149-
memcpy(tp_doc, str, n+1);
2156+
memcpy(tp_doc, doc_str, len + 1);
21502157
type->tp_doc = tp_doc;
21512158
}
21522159
}

‎Python/import.c‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2131,13 +2131,15 @@ get_parent(PyObject *globals, char *buf, Py_ssize_t *p_buflen, int level)
21312131

21322132
if ((pkgname != NULL) && (pkgname != Py_None)) {
21332133
/* __package__ is set, so use it */
2134+
char *pkgname_str;
21342135
Py_ssize_t len;
2136+
21352137
if (!PyUnicode_Check(pkgname)) {
21362138
PyErr_SetString(PyExc_ValueError,
21372139
"__package__ set to non-string");
21382140
return NULL;
21392141
}
2140-
len = PyUnicode_GET_SIZE(pkgname);
2142+
pkgname_str = PyUnicode_AsStringAndSize(pkgname, &len);
21412143
if (len == 0) {
21422144
if (level > 0) {
21432145
PyErr_SetString(PyExc_ValueError,
@@ -2151,7 +2153,7 @@ get_parent(PyObject *globals, char *buf, Py_ssize_t *p_buflen, int level)
21512153
"Package name too long");
21522154
return NULL;
21532155
}
2154-
strcpy(buf, PyUnicode_AsString(pkgname));
2156+
strcpy(buf, pkgname_str);
21552157
} else {
21562158
/* __package__ not set, so figure it out and set it */
21572159
modname = PyDict_GetItem(globals, namestr);
@@ -2161,14 +2163,17 @@ get_parent(PyObject *globals, char *buf, Py_ssize_t *p_buflen, int level)
21612163
modpath = PyDict_GetItem(globals, pathstr);
21622164
if (modpath != NULL) {
21632165
/* __path__ is set, so modname is already the package name */
2164-
Py_ssize_t len = PyUnicode_GET_SIZE(modname);
2166+
char *modname_str;
2167+
Py_ssize_t len;
21652168
int error;
2169+
2170+
modname_str = PyUnicode_AsStringAndSize(modname, &len);
21662171
if (len > MAXPATHLEN) {
21672172
PyErr_SetString(PyExc_ValueError,
21682173
"Module name too long");
21692174
return NULL;
21702175
}
2171-
strcpy(buf, PyUnicode_AsString(modname));
2176+
strcpy(buf, modname_str);
21722177
error = PyDict_SetItem(globals, pkgstr, modname);
21732178
if (error) {
21742179
PyErr_SetString(PyExc_ValueError,

‎Python/structmember.c‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -239,15 +239,22 @@ PyMember_SetOne(char *addr, PyMemberDef *l, PyObject *v)
239239
*(PyObject **)addr = v;
240240
Py_XDECREF(oldv);
241241
break;
242-
case T_CHAR:
243-
if (PyUnicode_Check(v) && PyUnicode_GetSize(v) == 1) {
244-
*(char*)addr = PyUnicode_AsString(v)[0];
242+
case T_CHAR: {
243+
char *string;
244+
Py_ssize_t len;
245+
246+
if (!PyUnicode_Check(v)) {
247+
PyErr_BadArgument();
248+
return -1;
245249
}
246-
else {
250+
string = PyUnicode_AsStringAndSize(v, &len);
251+
if (len != 1) {
247252
PyErr_BadArgument();
248253
return -1;
249254
}
255+
*(char*)addr = string[0];
250256
break;
257+
}
251258
#ifdef HAVE_LONG_LONG
252259
case T_LONGLONG:{
253260
PY_LONG_LONG value;

0 commit comments

Comments
 (0)