Issue #15989: Fix several occurrences of integer overflow
when result of PyLong_AsLong() narrowed to int without checks.
diff --git a/Modules/_ctypes/stgdict.c b/Modules/_ctypes/stgdict.c
index e5b0e4c..25d9996 100644
--- a/Modules/_ctypes/stgdict.c
+++ b/Modules/_ctypes/stgdict.c
@@ -335,7 +335,7 @@
isPacked = PyObject_GetAttrString(type, "_pack_");
if (isPacked) {
- pack = PyLong_AsLong(isPacked);
+ pack = _PyLong_AsInt(isPacked);
if (pack < 0 || PyErr_Occurred()) {
Py_XDECREF(isPacked);
PyErr_SetString(PyExc_ValueError,
diff --git a/Modules/_io/fileio.c b/Modules/_io/fileio.c
index 34425b7..fd7c1fc 100644
--- a/Modules/_io/fileio.c
+++ b/Modules/_io/fileio.c
@@ -244,7 +244,7 @@
return -1;
}
- fd = PyLong_AsLong(nameobj);
+ fd = _PyLong_AsInt(nameobj);
if (fd < 0) {
if (!PyErr_Occurred()) {
PyErr_SetString(PyExc_ValueError,
@@ -382,7 +382,7 @@
goto error;
}
- self->fd = PyLong_AsLong(fdobj);
+ self->fd = _PyLong_AsInt(fdobj);
Py_DECREF(fdobj);
if (self->fd == -1) {
goto error;
diff --git a/Modules/_io/textio.c b/Modules/_io/textio.c
index 4fc0caa..afd8d41 100644
--- a/Modules/_io/textio.c
+++ b/Modules/_io/textio.c
@@ -881,7 +881,7 @@
}
}
else {
- int fd = (int) PyLong_AsLong(fileno);
+ int fd = _PyLong_AsInt(fileno);
Py_DECREF(fileno);
if (fd == -1 && PyErr_Occurred()) {
goto error;
diff --git a/Modules/parsermodule.c b/Modules/parsermodule.c
index fea603e..e86fe4d 100644
--- a/Modules/parsermodule.c
+++ b/Modules/parsermodule.c
@@ -725,7 +725,7 @@
/* elem must always be a sequence, however simple */
PyObject* elem = PySequence_GetItem(tuple, i);
int ok = elem != NULL;
- long type = 0;
+ int type = 0;
char *strn = 0;
if (ok)
@@ -736,8 +736,14 @@
ok = 0;
else {
ok = PyLong_Check(temp);
- if (ok)
- type = PyLong_AS_LONG(temp);
+ if (ok) {
+ type = _PyLong_AsInt(temp);
+ if (type == -1 && PyErr_Occurred()) {
+ Py_DECREF(temp);
+ Py_DECREF(elem);
+ return 0;
+ }
+ }
Py_DECREF(temp);
}
}
@@ -773,8 +779,16 @@
if (len == 3) {
PyObject *o = PySequence_GetItem(elem, 2);
if (o != NULL) {
- if (PyLong_Check(o))
- *line_num = PyLong_AS_LONG(o);
+ if (PyLong_Check(o)) {
+ int num = _PyLong_AsInt(o);
+ if (num == -1 && PyErr_Occurred()) {
+ Py_DECREF(o);
+ Py_DECREF(temp);
+ Py_DECREF(elem);
+ return 0;
+ }
+ *line_num = num;
+ }
else {
PyErr_Format(parser_error,
"third item in terminal node must be an"
diff --git a/Modules/posixmodule.c b/Modules/posixmodule.c
index 24585c5..fb58507 100644
--- a/Modules/posixmodule.c
+++ b/Modules/posixmodule.c
@@ -7647,7 +7647,7 @@
int fds[2];
int res;
- flags = PyLong_AsLong(arg);
+ flags = _PyLong_AsInt(arg);
if (flags == -1 && PyErr_Occurred())
return NULL;
diff --git a/Modules/selectmodule.c b/Modules/selectmodule.c
index 52be4d8..e79bea3 100644
--- a/Modules/selectmodule.c
+++ b/Modules/selectmodule.c
@@ -352,10 +352,13 @@
i = pos = 0;
while (PyDict_Next(self->dict, &pos, &key, &value)) {
- self->ufds[i].fd = PyLong_AsLong(key);
+ assert(i < self->ufd_len);
+ /* Never overflow */
+ self->ufds[i].fd = (int)PyLong_AsLong(key);
self->ufds[i].events = (short)PyLong_AsLong(value);
i++;
}
+ assert(i == self->ufd_len);
self->ufd_uptodate = 1;
return 1;
}
@@ -371,10 +374,11 @@
poll_register(pollObject *self, PyObject *args)
{
PyObject *o, *key, *value;
- int fd, events = POLLIN | POLLPRI | POLLOUT;
+ int fd;
+ short events = POLLIN | POLLPRI | POLLOUT;
int err;
- if (!PyArg_ParseTuple(args, "O|i:register", &o, &events)) {
+ if (!PyArg_ParseTuple(args, "O|h:register", &o, &events)) {
return NULL;
}
@@ -513,7 +517,7 @@
tout = PyNumber_Long(tout);
if (!tout)
return NULL;
- timeout = PyLong_AsLong(tout);
+ timeout = _PyLong_AsInt(tout);
Py_DECREF(tout);
if (timeout == -1 && PyErr_Occurred())
return NULL;
diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c
index 4cd6903..94793c9 100644
--- a/Modules/socketmodule.c
+++ b/Modules/socketmodule.c
@@ -2013,7 +2013,7 @@
static PyObject *
sock_setblocking(PySocketSockObject *s, PyObject *arg)
{
- int block;
+ long block;
block = PyLong_AsLong(arg);
if (block == -1 && PyErr_Occurred())
@@ -2495,7 +2495,7 @@
int backlog;
int res;
- backlog = PyLong_AsLong(arg);
+ backlog = _PyLong_AsInt(arg);
if (backlog == -1 && PyErr_Occurred())
return NULL;
Py_BEGIN_ALLOW_THREADS
@@ -3647,7 +3647,7 @@
int how;
int res;
- how = PyLong_AsLong(arg);
+ how = _PyLong_AsInt(arg);
if (how == -1 && PyErr_Occurred())
return NULL;
Py_BEGIN_ALLOW_THREADS