bpo-35090: Fix potential division by zero in allocator wrappers (GH-10174)
* Fix potential division by zero in BZ2_Malloc()
* Avoid division by zero in PyLzma_Malloc()
* Avoid division by zero and integer overflow in PyZlib_Malloc()
Reported by Svace static analyzer.
diff --git a/Modules/_bz2module.c b/Modules/_bz2module.c
index 3890b60..f0d9588 100644
--- a/Modules/_bz2module.c
+++ b/Modules/_bz2module.c
@@ -277,11 +277,11 @@
{
if (items < 0 || size < 0)
return NULL;
- if ((size_t)items > (size_t)PY_SSIZE_T_MAX / (size_t)size)
+ if (size != 0 && (size_t)items > (size_t)PY_SSIZE_T_MAX / (size_t)size)
return NULL;
/* PyMem_Malloc() cannot be used: compress() and decompress()
release the GIL */
- return PyMem_RawMalloc(items * size);
+ return PyMem_RawMalloc((size_t)items * (size_t)size);
}
static void
diff --git a/Modules/_lzmamodule.c b/Modules/_lzmamodule.c
index 7b501d8..bb7a7ec 100644
--- a/Modules/_lzmamodule.c
+++ b/Modules/_lzmamodule.c
@@ -108,7 +108,7 @@
static void*
PyLzma_Malloc(void *opaque, size_t items, size_t size)
{
- if (items > (size_t)PY_SSIZE_T_MAX / size)
+ if (size != 0 && items > (size_t)PY_SSIZE_T_MAX / size)
return NULL;
/* PyMem_Malloc() cannot be used:
the GIL is not held when lzma_code() is called */
diff --git a/Modules/zlibmodule.c b/Modules/zlibmodule.c
index 36a3835..00bbe21 100644
--- a/Modules/zlibmodule.c
+++ b/Modules/zlibmodule.c
@@ -117,11 +117,11 @@
static void*
PyZlib_Malloc(voidpf ctx, uInt items, uInt size)
{
- if (items > (size_t)PY_SSIZE_T_MAX / size)
+ if (size != 0 && items > (size_t)PY_SSIZE_T_MAX / size)
return NULL;
/* PyMem_Malloc() cannot be used: the GIL is not held when
inflate() and deflate() are called */
- return PyMem_RawMalloc(items * size);
+ return PyMem_RawMalloc((size_t)items * (size_t)size);
}
static void