| commit | 550b945fd66f1c6837a53fbf29dc8e524297b8c3 | [log] [tgz] |
|---|---|---|
| author | Benjamin Peterson <benjamin@python.org> | Mon Jun 23 20:12:27 2014 -0700 |
| committer | Benjamin Peterson <benjamin@python.org> | Mon Jun 23 20:12:27 2014 -0700 |
| tree | 9d6b81940eca93ae47d34fdde011be411aa68c80 | |
| parent | 58eb605ca3735b9d9b608de1a1ffeec14c516e40 [diff] [blame] |
avoid overflow with large buffer sizes and/or offsets (closes #21831)
diff --git a/Objects/bufferobject.c b/Objects/bufferobject.c index 23b97b2..bcfab71 100644 --- a/Objects/bufferobject.c +++ b/Objects/bufferobject.c
@@ -88,7 +88,7 @@ *size = count; else *size = self->b_size; - if (offset + *size > count) + if (*size > count - offset) *size = count - offset; } return 1; @@ -875,4 +875,4 @@ 0, /* tp_init */ 0, /* tp_alloc */ buffer_new, /* tp_new */ -}; \ No newline at end of file +};