mirrors/cpython
0
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2024-12-04 07:15:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

Issue #28275: Fixed possible use adter free in LZMADecompressor.decompress().

Browse Source 
Original patch by John Leitch.
This commit is contained in:
Serhiy Storchaka 2016-09-27 20:23:41 +03:00
commit a12e7842a5
3 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Lib/test/test_lzma.py
View File

@ -246,6 +246,15 @@ class CompressorDecompressorTestCase(unittest.TestCase):
lzd = LZMADecompressor(lzma.FORMAT_RAW, filters=FILTERS_RAW_1)
self.assertRaises(LZMAError, lzd.decompress, COMPRESSED_XZ)
def test_decompressor_bug_28275(self):
# Test coverage for Issue 28275
lzd = LZMADecompressor()
for i in range(2):
try:
lzd.decompress(COMPRESSED_RAW_1)
except LZMAError:
pass
# Test that LZMACompressor->LZMADecompressor preserves the input data.
def test_roundtrip_xz(self):

3
Misc/NEWS
View File

@ -41,6 +41,9 @@ Core and Builtins
Library
-------
- Issue #28275: Fixed possible use adter free in LZMADecompressor.decompress().
Original patch by John Leitch.
- Issue #27897: Fixed possible crash in sqlite3.Connection.create_collation()
if pass invalid string-like object as a name. Patch by Xiang Zhang.

4
Modules/_lzmamodule.c
View File

@ -995,8 +995,10 @@ decompress(Decompressor *d, uint8_t *data, size_t len, Py_ssize_t max_length)
}
result = decompress_buf(d, max_length);
if(result == NULL)
if (result == NULL) {
lzs->next_in = NULL;
return NULL;
}
if (d->eof) {
d->needs_input = 0;