Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d4c0a9c

Browse files
malemburgmalemburg
committed
Fixes for possible buffer overflows in sprintf() usages.
1 parent 5107b4c commit d4c0a9c

8 files changed

Lines changed: 17 additions & 22 deletions

File tree

‎Modules/_testcapimodule.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ sizeof_error(const char* fatname, const char* typename,
3636
int expected, int got)
3737
{
3838
char buf[1024];
39-
sprintf(buf, "%s #define == %d but sizeof(%s) == %d",
39+
sprintf(buf, "%.200s #define == %d but sizeof(%.200s) == %d",
4040
fatname, expected, typename, got);
4141
PyErr_SetString(TestError, buf);
4242
return (PyObject*)NULL;

‎Modules/posixmodule.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5787,7 +5787,7 @@ static int insertvalues(PyObject *d)
57875787
APIRET rc;
57885788
ULONG values[QSV_MAX+1];
57895789
PyObject *v;
5790-
char *ver, tmp[10];
5790+
char *ver, tmp[50];
57915791

57925792
Py_BEGIN_ALLOW_THREADS
57935793
rc = DosQuerySysInfo(1, QSV_MAX, &values[1], sizeof(values));

‎Modules/readline.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ set_hook(const char * funcname, PyObject **hook_var, PyThreadState **tstate, PyO
165165
{
166166
PyObject *function = Py_None;
167167
char buf[80];
168-
sprintf(buf, "|O:set_%s", funcname);
168+
sprintf(buf, "|O:set_%.50s", funcname);
169169
if (!PyArg_ParseTuple(args, buf, &function))
170170
return NULL;
171171
if (function == Py_None) {
@@ -181,7 +181,7 @@ set_hook(const char * funcname, PyObject **hook_var, PyThreadState **tstate, PyO
181181
*tstate = PyThreadState_Get();
182182
}
183183
else {
184-
sprintf(buf, "set_%s(func): argument not callable", funcname);
184+
sprintf(buf, "set_%.50s(func): argument not callable", funcname);
185185
PyErr_SetString(PyExc_TypeError, buf);
186186
return NULL;
187187
}

‎Objects/weakrefobject.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ weakref_repr(PyWeakReference *self)
135135
(long)(self));
136136
}
137137
else {
138-
sprintf(buffer, "<weakref at %#lx; to '%s' at %#lx>",
138+
sprintf(buffer, "<weakref at %#lx; to '%.50s' at %#lx>",
139139
(long)(self), PyWeakref_GET_OBJECT(self)->ob_type->tp_name,
140140
(long)(PyWeakref_GET_OBJECT(self)));
141141
}

‎Python/compile.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4195,7 +4195,7 @@ get_ref_type(struct compiling *c, char *name)
41954195
return GLOBAL_IMPLICIT;
41964196
}
41974197
}
4198-
sprintf(buf,
4198+
PyOS_snprintf(buf, sizeof(buf),
41994199
"unknown scope for %.100s in %.100s(%s) "
42004200
"in %s\nsymbols: %s\nlocals: %s\nglobals: %s\n",
42014201
name, c->c_name,

‎Python/dynload_os2.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ dl_funcptr _PyImport_GetDynLoadFunc(const char *fqname, const char *shortname,
3232
if (rc != NO_ERROR) {
3333
char errBuf[256];
3434
sprintf(errBuf,
35-
"DLL load failed, rc = %d: %s",
35+
"DLL load failed, rc = %d: %.200s",
3636
rc, failreason);
3737
PyErr_SetString(PyExc_ImportError, errBuf);
3838
return NULL;

‎Python/dynload_win.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -232,7 +232,7 @@ dl_funcptr _PyImport_GetDynLoadFunc(const char *fqname, const char *shortname,
232232
if (import_python &&
233233
strcasecmp(buffer,import_python)) {
234234
sprintf(buffer,
235-
"Module use of %s conflicts "
235+
"Module use of %.150s conflicts "
236236
"with this version of Python.",
237237
import_python);
238238
PyErr_SetString(PyExc_ImportError,buffer);

‎Python/getargs.c‎

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,6 @@
11

22
/* New getargs implementation */
33

4-
/* XXX There are several unchecked sprintf or strcat calls in this file.
5-
XXX The only way these can become a danger is if some C code in the
6-
XXX Python source (or in an extension) uses ridiculously long names
7-
XXX or ridiculously deep nesting in format strings. */
8-
94
#include "Python.h"
105

116
#include <ctype.h>
@@ -140,7 +135,7 @@ vgetargs1(PyObject *args, char *format, va_list *p_va, int compat)
140135
if (max == 0) {
141136
if (args == NULL)
142137
return 1;
143-
sprintf(msgbuf, "%s%s takes no arguments",
138+
sprintf(msgbuf, "%.200s%s takes no arguments",
144139
fname==NULL ? "function" : fname,
145140
fname==NULL ? "" : "()");
146141
PyErr_SetString(PyExc_TypeError, msgbuf);
@@ -149,7 +144,7 @@ vgetargs1(PyObject *args, char *format, va_list *p_va, int compat)
149144
else if (min == 1 && max == 1) {
150145
if (args == NULL) {
151146
sprintf(msgbuf,
152-
"%s%s takes at least one argument",
147+
"%.200s%s takes at least one argument",
153148
fname==NULL ? "function" : fname,
154149
fname==NULL ? "" : "()");
155150
PyErr_SetString(PyExc_TypeError, msgbuf);
@@ -179,7 +174,7 @@ vgetargs1(PyObject *args, char *format, va_list *p_va, int compat)
179174
if (len < min || max < len) {
180175
if (message == NULL) {
181176
sprintf(msgbuf,
182-
"%s%s takes %s %d argument%s (%d given)",
177+
"%.150s%s takes %s %d argument%s (%d given)",
183178
fname==NULL ? "function" : fname,
184179
fname==NULL ? "" : "()",
185180
min==max ? "exactly"
@@ -220,22 +215,22 @@ vgetargs1(PyObject *args, char *format, va_list *p_va, int compat)
220215
static void
221216
seterror(int iarg, char *msg, int *levels, char *fname, char *message)
222217
{
223-
char buf[256];
218+
char buf[512];
224219
int i;
225220
char *p = buf;
226221

227222
if (PyErr_Occurred())
228223
return;
229224
else if (message == NULL) {
230225
if (fname != NULL) {
231-
sprintf(p, "%s() ", fname);
226+
sprintf(p, "%.200s() ", fname);
232227
p += strlen(p);
233228
}
234229
if (iarg != 0) {
235230
sprintf(p, "argument %d", iarg);
236231
i = 0;
237232
p += strlen(p);
238-
while (levels[i] > 0) {
233+
while (levels[i] > 0 && (int)(p-buf) < 220) {
239234
sprintf(p, ", item %d", levels[i]-1);
240235
p += strlen(p);
241236
i++;
@@ -245,7 +240,7 @@ seterror(int iarg, char *msg, int *levels, char *fname, char *message)
245240
sprintf(p, "argument");
246241
p += strlen(p);
247242
}
248-
sprintf(p, " %s", msg);
243+
sprintf(p, " %.256s", msg);
249244
message = buf;
250245
}
251246
PyErr_SetString(PyExc_TypeError, message);
@@ -300,8 +295,8 @@ converttuple(PyObject *arg, char **p_format, va_list *p_va, int *levels,
300295
if (!PySequence_Check(arg) || PyString_Check(arg)) {
301296
levels[0] = 0;
302297
sprintf(msgbuf,
303-
toplevel ? "expected %d arguments, not %s" :
304-
"must be %d-item sequence, not %s",
298+
toplevel ? "expected %d arguments, not %.50s" :
299+
"must be %d-item sequence, not %.50s",
305300
n, arg == Py_None ? "None" : arg->ob_type->tp_name);
306301
return msgbuf;
307302
}

0 commit comments

Comments
 (0)