bpo-30058: Fixed buffer overflow in select.kqueue.control(). #1095
Conversation
serhiy-storchaka added type-bug 
| @serhiy-storchaka, thanks for your PR! By analyzing the history of the files in this pull request, we identified @tiran, @cf-natali and @akuchling to be potential reviewers. |
Modules/selectmodule.c Outdated
| if (nchanges < 0) { | ||
| goto error; | ||
| } | ||
| nchanges = PySequence_Fast_GET_SIZE(arg); |
There was a problem hiding this comment.
PySequence_Fast_GET_SIZE returns a Py_ssize_t. This may trigger a compile warning.
Modules/selectmodule.c Outdated
| } | ||
| nchanges = PyObject_Size(ch); | ||
| if (nchanges < 0) { | ||
| if (PySequence_Fast_GET_SIZE(arg) > INT_MAX / sizeof(struct kevent)) { |
There was a problem hiding this comment.
arg should be seq, right?
I don't think we need to / sizeof(struct kevent). > INT_MAX is enough. Then there will be a memory error below. Or use PY_SSIZE_T_MAX here, assuming PY_SSIZE_T_MAX / sizeof(struct kevent) <= INT_MAX.
zhangyangyu left a comment
zhangyangyu left a comment There was a problem hiding this comment.
LGTM from code. But I can't even compile.
Lib/test/test_kqueue.py Outdated
| kq.close() | ||
| | ||
| def test_issue30058(self): | ||
| # chagelist must be an iterable |
There was a problem hiding this comment.
typo: chagelist -> changelist
There was a problem hiding this comment.
Good catch @lulouie!
| @zhangyangyu why can't you compile? My env compile it well. |
| @lulouie , the code is specialized for BSD. I only have access to Linux. Compiling it on Linux doesn't make any sense. |
| @zhangyangyu ah, It has compiled on Linux, but only the GNU part, not BSD part. |
| Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 2.7, 3.6. |
| GH-3973 is a backport of this pull request to the 3.6 branch. |
…ythonGH-1095) (cherry picked from commit de07210)
| Sorry, @serhiy-storchaka, I could not cleanly backport this to |
…ythonGH-1095). (cherry picked from commit de07210)
| GH-3976 is a backport of this pull request to the 2.7 branch. |
9 participants
https://bugs.python.org/issue30058