changeset:   97068:2d39777f3477
branch:      2.7
parent:      97065:a789ee93f152
user:        Serhiy Storchaka <storchaka@gmail.com>
date:        Sun Jul 26 08:49:37 2015 +0300
files:       Lib/test/test_array.py Misc/NEWS Modules/arraymodule.c
description:
Issue #24613: Calling array.fromstring() with self is no longer allowed
to prevent the use-after-free error.  Patch by John Leitch.


diff -r a789ee93f152 -r 2d39777f3477 Lib/test/test_array.py
--- a/Lib/test/test_array.py	Sat Jul 25 10:20:13 2015 -0700
+++ b/Lib/test/test_array.py	Sun Jul 26 08:49:37 2015 +0300
@@ -247,6 +247,7 @@
         self.assertRaises(TypeError, a.tostring, 42)
         self.assertRaises(TypeError, b.fromstring)
         self.assertRaises(TypeError, b.fromstring, 42)
+        self.assertRaises(ValueError, a.fromstring, a)
         b.fromstring(a.tostring())
         self.assertEqual(a, b)
         if a.itemsize>1:
diff -r a789ee93f152 -r 2d39777f3477 Misc/NEWS
--- a/Misc/NEWS	Sat Jul 25 10:20:13 2015 -0700
+++ b/Misc/NEWS	Sun Jul 26 08:49:37 2015 +0300
@@ -34,6 +34,9 @@
 Library
 -------
 
+- Issue #24613: Calling array.fromstring() with self is no longer allowed
+  to prevent the use-after-free error.  Patch by John Leitch.
+
 - Issue #24708: Fix possible integer overflow in strop.replace().
 
 - Issue #24620: Random.setstate() now validates the value of state last element.
diff -r a789ee93f152 -r 2d39777f3477 Modules/arraymodule.c
--- a/Modules/arraymodule.c	Sat Jul 25 10:20:13 2015 -0700
+++ b/Modules/arraymodule.c	Sun Jul 26 08:49:37 2015 +0300
@@ -1380,6 +1380,11 @@
     int itemsize = self->ob_descr->itemsize;
     if (!PyArg_ParseTuple(args, "s#:fromstring", &str, &n))
         return NULL;
+    if (str == self->ob_item) {
+        PyErr_SetString(PyExc_ValueError,
+                        "array.fromstring(x): x cannot be self");
+        return NULL;
+    }
     if (n % itemsize != 0) {
         PyErr_SetString(PyExc_ValueError,
                    "string length not a multiple of item size");