check the result of PyByteArray_Resize in readline() (closes #27211)
diff --git a/Misc/NEWS b/Misc/NEWS
index 309cb62..71a9209 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -89,6 +89,8 @@
Library
-------
+- Issue #27211: Fix possible memory corruption in io.IOBase.readline().
+
- Issue #27114: Fix SSLContext._load_windows_store_certs fails with
PermissionError
diff --git a/Modules/_io/iobase.c b/Modules/_io/iobase.c
index ab6911d..61756d0 100644
--- a/Modules/_io/iobase.c
+++ b/Modules/_io/iobase.c
@@ -529,7 +529,10 @@
}
old_size = PyByteArray_GET_SIZE(buffer);
- PyByteArray_Resize(buffer, old_size + PyBytes_GET_SIZE(b));
+ if (PyByteArray_Resize(buffer, old_size + PyBytes_GET_SIZE(b)) < 0) {
+ Py_DECREF(b);
+ goto fail;
+ }
memcpy(PyByteArray_AS_STRING(buffer) + old_size,
PyBytes_AS_STRING(b), PyBytes_GET_SIZE(b));