Merged revisions 65654 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/trunk
........
r65654 | martin.v.loewis | 2008-08-12 16:49:50 +0200 (Tue, 12 Aug 2008) | 6 lines
Issue #3139: Make buffer-interface thread-safe wrt. PyArg_ParseTuple,
by denying s# to parse objects that have a releasebuffer procedure,
and introducing s*.
More module might need to get converted to use s*.
........
diff --git a/Modules/fcntlmodule.c b/Modules/fcntlmodule.c
index 46bf4d1..5331ea8 100644
--- a/Modules/fcntlmodule.c
+++ b/Modules/fcntlmodule.c
@@ -113,15 +113,18 @@
unsigned int code;
int arg;
int ret;
+ Py_buffer pstr;
char *str;
Py_ssize_t len;
int mutate_arg = 1;
char buf[IOCTL_BUFSZ+1]; /* argument plus NUL byte */
- if (PyArg_ParseTuple(args, "O&Iw#|i:ioctl",
+ if (PyArg_ParseTuple(args, "O&Iw*|i:ioctl",
conv_descriptor, &fd, &code,
- &str, &len, &mutate_arg)) {
+ &pstr, &mutate_arg)) {
char *arg;
+ str = pstr.buf;
+ len = pstr.len;
if (mutate_arg) {
if (len <= IOCTL_BUFSZ) {
@@ -135,6 +138,7 @@
}
else {
if (len > IOCTL_BUFSZ) {
+ PyBuffer_Release(&pstr);
PyErr_SetString(PyExc_ValueError,
"ioctl string arg too long");
return NULL;
@@ -156,6 +160,7 @@
if (mutate_arg && (len < IOCTL_BUFSZ)) {
memcpy(str, buf, len);
}
+ PyBuffer_Release(&pstr); /* No further access to str below this point */
if (ret < 0) {
PyErr_SetFromErrno(PyExc_IOError);
return NULL;
@@ -169,9 +174,12 @@
}
PyErr_Clear();
- if (PyArg_ParseTuple(args, "O&Is#:ioctl",
- conv_descriptor, &fd, &code, &str, &len)) {
+ if (PyArg_ParseTuple(args, "O&Is*:ioctl",
+ conv_descriptor, &fd, &code, &pstr)) {
+ str = pstr.buf;
+ len = pstr.len;
if (len > IOCTL_BUFSZ) {
+ PyBuffer_Release(&pstr);
PyErr_SetString(PyExc_ValueError,
"ioctl string arg too long");
return NULL;
@@ -182,9 +190,11 @@
ret = ioctl(fd, code, buf);
Py_END_ALLOW_THREADS
if (ret < 0) {
+ PyBuffer_Release(&pstr);
PyErr_SetFromErrno(PyExc_IOError);
return NULL;
}
+ PyBuffer_Release(&pstr);
return PyBytes_FromStringAndSize(buf, len);
}