@@ -83,28 +83,28 @@ static struct module_state _state;
83
83
*/
84
84
#if defined(_MSC_VER ) && (_MSC_VER >= 1400 )
85
85
#define INT2STRING (buffer , i ) \
86
- *(buffer) = malloc(_scprintf("%ld ", (i)) + 1), \
86
+ *(buffer) = malloc(_scprintf("%d ", (i)) + 1), \
87
87
(!(buffer) ? \
88
88
-1 : \
89
89
_snprintf_s(*(buffer), \
90
- _scprintf("%ld ", (i)) + 1, \
91
- _scprintf("%ld ", (i)) + 1, \
92
- "%ld", \
90
+ _scprintf("%d ", (i)) + 1, \
91
+ _scprintf("%d ", (i)) + 1, \
92
+ "%d", \
93
93
(i)))
94
94
#define STRCAT (dest , n , src ) strcat_s((dest), (n), (src))
95
95
#else
96
96
#define INT2STRING (buffer , i ) \
97
- *(buffer) = malloc(_scprintf("%ld ", (i)) + 1), \
97
+ *(buffer) = malloc(_scprintf("%d ", (i)) + 1), \
98
98
(!(buffer) ? \
99
99
-1 : \
100
100
_snprintf(*(buffer), \
101
- _scprintf("%ld ", (i)) + 1, \
102
- "%ld", \
101
+ _scprintf("%d ", (i)) + 1, \
102
+ "%d", \
103
103
(i)))
104
104
#define STRCAT (dest , n , src ) strcat((dest), (src))
105
105
#endif
106
106
#else
107
- #define INT2STRING (buffer , i ) asprintf((buffer), "%ld ", (i))
107
+ #define INT2STRING (buffer , i ) asprintf((buffer), "%d ", (i))
108
108
#define STRCAT (dest , n , src ) strcat((dest), (src))
109
109
#endif
110
110
@@ -453,7 +453,15 @@ static int _write_element_to_buffer(PyObject* self, buffer_t buffer, int type_by
453
453
return 0 ;
454
454
}
455
455
456
- items = PySequence_Size (value );
456
+ if ((items = PySequence_Size (value )) > BSON_MAX_SIZE ) {
457
+ PyObject * BSONError = _error ("BSONError" );
458
+ if (BSONError ) {
459
+ PyErr_SetString (BSONError ,
460
+ "Too many items to serialize." );
461
+ Py_DECREF (BSONError );
462
+ }
463
+ return 0 ;
464
+ }
457
465
for (i = 0 ; i < items ; i ++ ) {
458
466
int list_type_byte = buffer_save_space (buffer , 1 );
459
467
char * name = NULL ;
@@ -463,7 +471,7 @@ static int _write_element_to_buffer(PyObject* self, buffer_t buffer, int type_by
463
471
PyErr_NoMemory ();
464
472
return 0 ;
465
473
}
466
- if (INT2STRING (& name , i ) < 0 || !name ) {
474
+ if (INT2STRING (& name , ( int ) i ) < 0 || !name ) {
467
475
PyErr_NoMemory ();
468
476
return 0 ;
469
477
}
@@ -1449,12 +1457,12 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
1449
1457
1450
1458
int bson_type = (int )buffer [(* position )++ ];
1451
1459
size_t key_size = strlen (buffer + * position );
1452
- if (( size_t )( int ) key_size != key_size ) {
1460
+ if (key_size > BSON_MAX_SIZE ) {
1453
1461
Py_DECREF (value );
1454
1462
goto invalid ;
1455
1463
}
1456
1464
/* just skip the key, they're in order. */
1457
- * position += key_size + 1 ;
1465
+ * position += ( int ) key_size + 1 ;
1458
1466
to_append = get_value (self , buffer , position , bson_type ,
1459
1467
max - (int )key_size , as_class , tz_aware , uuid_subtype );
1460
1468
if (!to_append ) {
@@ -1659,15 +1667,18 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
1659
1667
int flags ;
1660
1668
size_t flags_length , i ;
1661
1669
size_t pattern_length = strlen (buffer + * position );
1662
- if (max < pattern_length ) {
1670
+ if (max < pattern_length || pattern_length > BSON_MAX_SIZE ) {
1663
1671
goto invalid ;
1664
1672
}
1665
1673
pattern = PyUnicode_DecodeUTF8 (buffer + * position , pattern_length , "strict" );
1666
1674
if (!pattern ) {
1667
1675
return NULL ;
1668
1676
}
1669
- * position += pattern_length + 1 ;
1670
- flags_length = strlen (buffer + * position );
1677
+ * position += (int )pattern_length + 1 ;
1678
+ if ((flags_length = strlen (buffer + * position )) > BSON_MAX_SIZE ) {
1679
+ Py_DECREF (pattern );
1680
+ goto invalid ;
1681
+ }
1671
1682
if (max < pattern_length + flags_length ) {
1672
1683
Py_DECREF (pattern );
1673
1684
goto invalid ;
@@ -1688,7 +1699,7 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
1688
1699
flags |= 64 ;
1689
1700
}
1690
1701
}
1691
- * position += flags_length + 1 ;
1702
+ * position += ( int ) flags_length + 1 ;
1692
1703
value = PyObject_CallFunction (state -> RECompile , "Oi" , pattern , flags );
1693
1704
Py_DECREF (pattern );
1694
1705
break ;
@@ -1701,14 +1712,14 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
1701
1712
1702
1713
* position += 4 ;
1703
1714
collection_length = strlen (buffer + * position );
1704
- if (max < collection_length ) {
1715
+ if (max < collection_length || collection_length > BSON_MAX_SIZE ) {
1705
1716
goto invalid ;
1706
1717
}
1707
1718
collection = PyUnicode_DecodeUTF8 (buffer + * position , collection_length , "strict" );
1708
1719
if (!collection ) {
1709
1720
return NULL ;
1710
1721
}
1711
- * position += collection_length + 1 ;
1722
+ * position += ( int ) collection_length + 1 ;
1712
1723
if (max < collection_length + 12 ) {
1713
1724
Py_DECREF (collection );
1714
1725
goto invalid ;
@@ -1750,14 +1761,14 @@ static PyObject* get_value(PyObject* self, const char* buffer, int* position,
1750
1761
1751
1762
* position += 8 ;
1752
1763
code_length = strlen (buffer + * position );
1753
- if (max < 8 + code_length ) {
1764
+ if (max < 8 + code_length || code_length > BSON_MAX_SIZE ) {
1754
1765
goto invalid ;
1755
1766
}
1756
1767
code = PyUnicode_DecodeUTF8 (buffer + * position , code_length , "strict" );
1757
1768
if (!code ) {
1758
1769
return NULL ;
1759
1770
}
1760
- * position += code_length + 1 ;
1771
+ * position += ( int ) code_length + 1 ;
1761
1772
1762
1773
memcpy (& scope_size , buffer + * position , 4 );
1763
1774
scope = elements_to_dict (self , buffer + * position + 4 , scope_size - 5 ,
@@ -1866,7 +1877,7 @@ static PyObject* elements_to_dict(PyObject* self, const char* string, int max,
1866
1877
PyObject * value ;
1867
1878
int type = (int )string [position ++ ];
1868
1879
size_t name_length = strlen (string + position );
1869
- if (position + name_length >= max ) {
1880
+ if (name_length > BSON_MAX_SIZE || position + name_length >= max ) {
1870
1881
PyObject * InvalidBSON = _error ("InvalidBSON" );
1871
1882
if (InvalidBSON ) {
1872
1883
PyErr_SetNone (InvalidBSON );
@@ -1880,7 +1891,7 @@ static PyObject* elements_to_dict(PyObject* self, const char* string, int max,
1880
1891
Py_DECREF (dict );
1881
1892
return NULL ;
1882
1893
}
1883
- position += name_length + 1 ;
1894
+ position += ( int ) name_length + 1 ;
1884
1895
value = get_value (self , string , & position , type ,
1885
1896
max - position , as_class , tz_aware , uuid_subtype );
1886
1897
if (!value ) {
0 commit comments