commit 441d30fac7f4037e4a79e4ada873de3b6f6e5a26
author Serhiy Storchaka <storchaka@gmail.com> Sat Jan 19 12:26:26 2013 +0200
committer Serhiy Storchaka <storchaka@gmail.com> Sat Jan 19 12:26:26 2013 +0200
tree a406cb41f1b78476445786f408b95b1cd0bdb7a6
parent ff12fae80e15ad29ae2557d23e70f6ff9365b31f

Issue #15989: Fix several occurrences of integer overflow
when result of PyLong_AsLong() narrowed to int without checks.

This is a backport of changesets 13e2e44db99d and 525407d89277.

Modules/_ctypes/stgdict.c

diff --git a/Modules/_ctypes/stgdict.c b/Modules/_ctypes/stgdict.c
index 262d0b4..2338818 100644
--- a/Modules/_ctypes/stgdict.c
+++ b/Modules/_ctypes/stgdict.c
@@ -335,7 +335,7 @@
 
     isPacked = PyObject_GetAttrString(type, "_pack_");
     if (isPacked) {
-        pack = PyLong_AsLong(isPacked);
+        pack = _PyLong_AsInt(isPacked);
         if (pack < 0 || PyErr_Occurred()) {
             Py_XDECREF(isPacked);
             PyErr_SetString(PyExc_ValueError,

Modules/_io/_iomodule.c

diff --git a/Modules/_io/_iomodule.c b/Modules/_io/_iomodule.c
index cec0671..fe91a59 100644
--- a/Modules/_io/_iomodule.c
+++ b/Modules/_io/_iomodule.c
@@ -303,7 +303,8 @@
     int text = 0, binary = 0, universal = 0;
 
     char rawmode[5], *m;
-    int line_buffering, isatty;
+    int line_buffering;
+    long isatty;
 
     PyObject *raw, *modeobj = NULL, *buffer = NULL, *wrapper = NULL;
 
@@ -441,12 +442,12 @@
 #ifdef HAVE_STRUCT_STAT_ST_BLKSIZE
         {
             struct stat st;
-            long fileno;
+            int fileno;
             PyObject *res = PyObject_CallMethod(raw, "fileno", NULL);
             if (res == NULL)
                 goto error;
 
-            fileno = PyLong_AsLong(res);
+            fileno = _PyLong_AsInt(res);
             Py_DECREF(res);
             if (fileno == -1 && PyErr_Occurred())
                 goto error;

Modules/_io/fileio.c

diff --git a/Modules/_io/fileio.c b/Modules/_io/fileio.c
index 8ea7c58..ad4a7e6 100644
--- a/Modules/_io/fileio.c
+++ b/Modules/_io/fileio.c
@@ -240,7 +240,7 @@
         return -1;
     }
 
-    fd = PyLong_AsLong(nameobj);
+    fd = _PyLong_AsInt(nameobj);
     if (fd < 0) {
         if (!PyErr_Occurred()) {
             PyErr_SetString(PyExc_ValueError,

Modules/selectmodule.c

diff --git a/Modules/selectmodule.c b/Modules/selectmodule.c
index 0736215..3f846d8 100644
--- a/Modules/selectmodule.c
+++ b/Modules/selectmodule.c
@@ -340,10 +340,13 @@
 
     i = pos = 0;
     while (PyDict_Next(self->dict, &pos, &key, &value)) {
-        self->ufds[i].fd = PyLong_AsLong(key);
+        assert(i < self->ufd_len);
+        /* Never overflow */
+        self->ufds[i].fd = (int)PyLong_AsLong(key);
         self->ufds[i].events = (short)PyLong_AsLong(value);
         i++;
     }
+    assert(i == self->ufd_len);
     self->ufd_uptodate = 1;
     return 1;
 }
@@ -359,10 +362,11 @@
 poll_register(pollObject *self, PyObject *args)
 {
     PyObject *o, *key, *value;
-    int fd, events = POLLIN | POLLPRI | POLLOUT;
+    int fd;
+    short events = POLLIN | POLLPRI | POLLOUT;
     int err;
 
-    if (!PyArg_ParseTuple(args, "O|i:register", &o, &events)) {
+    if (!PyArg_ParseTuple(args, "O|h:register", &o, &events)) {
         return NULL;
     }
 
@@ -501,7 +505,7 @@
         tout = PyNumber_Long(tout);
         if (!tout)
             return NULL;
-        timeout = PyLong_AsLong(tout);
+        timeout = _PyLong_AsInt(tout);
         Py_DECREF(tout);
         if (timeout == -1 && PyErr_Occurred())
             return NULL;

Modules/socketmodule.c

diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c
index 4f896fd..bc3372f 100644
--- a/Modules/socketmodule.c
+++ b/Modules/socketmodule.c
@@ -1737,7 +1737,7 @@
 static PyObject *
 sock_setblocking(PySocketSockObject *s, PyObject *arg)
 {
-    int block;
+    long block;
 
     block = PyLong_AsLong(arg);
     if (block == -1 && PyErr_Occurred())
@@ -2219,7 +2219,7 @@
     int backlog;
     int res;
 
-    backlog = PyLong_AsLong(arg);
+    backlog = _PyLong_AsInt(arg);
     if (backlog == -1 && PyErr_Occurred())
         return NULL;
     Py_BEGIN_ALLOW_THREADS
@@ -2822,7 +2822,7 @@
     int how;
     int res;
 
-    how = PyLong_AsLong(arg);
+    how = _PyLong_AsInt(arg);
     if (how == -1 && PyErr_Occurred())
         return NULL;
     Py_BEGIN_ALLOW_THREADS