commit b1fc8c0c8aec7ef8edd119034e076bc48882ffbb
author Miss Skeleton (bot) <31488909+miss-islington@users.noreply.github.com> Mon Oct 21 02:12:37 2019 -0700
committer GitHub <noreply@github.com> Mon Oct 21 02:12:37 2019 -0700
tree 66fc7fb1b974e1fc3dd4d10af20db4a6dc1bb675
parent db385229645dbaaa9863e259b2fae67b9da873fe

bpo-38540: Fix possible leak in PyArg_Parse for "esGH-" and "etGH-". (GH-16869)

(cherry picked from commit 5bc6a7c06eda20ba131ecba6752be0506d310181)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

Python/getargs.c

diff --git a/Python/getargs.c b/Python/getargs.c
index c65530d..c1b7b1a 100644
--- a/Python/getargs.c
+++ b/Python/getargs.c
@@ -1199,7 +1199,19 @@
                trailing 0-byte
 
             */
-            FETCH_SIZE;
+            int *q = NULL; Py_ssize_t *q2 = NULL;
+            if (flags & FLAG_SIZE_T) {
+                q2 = va_arg(*p_va, Py_ssize_t*);
+            }
+            else {
+                if (PyErr_WarnEx(PyExc_DeprecationWarning,
+                            "PY_SSIZE_T_CLEAN will be required for '#' formats", 1))
+                {
+                    Py_DECREF(s);
+                    return NULL;
+                }
+                q = va_arg(*p_va, int*);
+            }
 
             format++;
             if (q == NULL && q2 == NULL) {
@@ -1232,7 +1244,19 @@
                 }
             }
             memcpy(*buffer, ptr, size+1);
-            STORE_SIZE(size);
+
+            if (flags & FLAG_SIZE_T) {
+                *q2 = size;
+            }
+            else {
+                if (INT_MAX < size) {
+                    Py_DECREF(s);
+                    PyErr_SetString(PyExc_OverflowError,
+                                    "size does not fit in an int");
+                    return converterr("", arg, msgbuf, bufsize);
+                }
+                *q = (int)size;
+            }
         } else {
             /* Using a 0-terminated buffer: