commit 64ea192b73e39e877d8b39ce6584fa580eb0e9b4
author Benjamin Peterson <benjamin@python.org> Wed Jan 20 22:23:44 2016 -0800
committer Benjamin Peterson <benjamin@python.org> Wed Jan 20 22:23:44 2016 -0800
tree fb193a5cec69549e3669412ac0ee3f94e2cd4944
parent e4309f7f14d25227b51f8ac012b2dcbb8da99e9d

prevent buffer overflow in get_data (closes #26171)

Modules/zipimport.c

diff --git a/Modules/zipimport.c b/Modules/zipimport.c
index 27a082d..006be3c 100644
--- a/Modules/zipimport.c
+++ b/Modules/zipimport.c
@@ -895,6 +895,11 @@
         PyMarshal_ReadShortFromFile(fp);        /* local header size */
     file_offset += l;           /* Start of file data */
 
+    if (data_size > LONG_MAX - 1) {
+        fclose(fp);
+        PyErr_NoMemory();
+        return NULL;
+    }
     raw_data = PyString_FromStringAndSize((char *)NULL, compress == 0 ?
                                           data_size : data_size + 1);
     if (raw_data == NULL) {