Bug 1688393. Adds a control of negative values in
socket.recvfrom, which caused an ugly crash.
diff --git a/Lib/test/test_socket.py b/Lib/test/test_socket.py
index 5be3dc3..24d1a5d 100644
--- a/Lib/test/test_socket.py
+++ b/Lib/test/test_socket.py
@@ -597,6 +597,13 @@
def _testRecvFrom(self):
self.cli.sendto(MSG, 0, (HOST, PORT))
+ def testRecvFromNegative(self):
+ # Negative lengths passed to recvfrom should give ValueError.
+ self.assertRaises(ValueError, self.serv.recvfrom, -1)
+
+ def _testRecvFromNegative(self):
+ self.cli.sendto(MSG, 0, (HOST, PORT))
+
class TCPCloserTest(ThreadedTCPSocketTest):
def testClose(self):
diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c
index cc54098..96682ca 100644
--- a/Modules/socketmodule.c
+++ b/Modules/socketmodule.c
@@ -2391,7 +2391,7 @@
if (recvlen < 0) {
PyErr_SetString(PyExc_ValueError,
- "negative buffersize in recv");
+ "negative buffersize in recv_into");
return NULL;
}
if (recvlen == 0) {
@@ -2507,6 +2507,12 @@
if (!PyArg_ParseTuple(args, "i|i:recvfrom", &recvlen, &flags))
return NULL;
+ if (recvlen < 0) {
+ PyErr_SetString(PyExc_ValueError,
+ "negative buffersize in recvfrom");
+ return NULL;
+ }
+
buf = PyString_FromStringAndSize((char *) 0, recvlen);
if (buf == NULL)
return NULL;
@@ -2560,7 +2566,7 @@
if (recvlen < 0) {
PyErr_SetString(PyExc_ValueError,
- "negative buffersize in recv");
+ "negative buffersize in recvfrom_into");
return NULL;
}
if (recvlen == 0) {