merge 3.5 (closes #27760)
diff --git a/Misc/NEWS b/Misc/NEWS
index 460789c..3cd4c9f 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -61,6 +61,8 @@
- In the curses module, raise an error if window.getstr() is passed a negative
value.
+- Issue #27760: Fix possible integer overflow in binascii.b2a_qp.
+
- Issue #27758: Fix possible integer overflow in the _csv module for large record
lengths.
diff --git a/Modules/binascii.c b/Modules/binascii.c
index 623c298..50b09fe 100644
--- a/Modules/binascii.c
+++ b/Modules/binascii.c
@@ -1370,6 +1370,7 @@
/* First, scan to see how many characters need to be encoded */
in = 0;
while (in < datalen) {
+ Py_ssize_t delta = 0;
if ((databuf[in] > 126) ||
(databuf[in] == '=') ||
(header && databuf[in] == '_') ||
@@ -1384,12 +1385,12 @@
if ((linelen + 3) >= MAXLINESIZE) {
linelen = 0;
if (crlf)
- odatalen += 3;
+ delta += 3;
else
- odatalen += 2;
+ delta += 2;
}
linelen += 3;
- odatalen += 3;
+ delta += 3;
in++;
}
else {
@@ -1401,11 +1402,11 @@
linelen = 0;
/* Protect against whitespace on end of line */
if (in && ((databuf[in-1] == ' ') || (databuf[in-1] == '\t')))
- odatalen += 2;
+ delta += 2;
if (crlf)
- odatalen += 2;
+ delta += 2;
else
- odatalen += 1;
+ delta += 1;
if (databuf[in] == '\r')
in += 2;
else
@@ -1417,15 +1418,20 @@
(linelen + 1) >= MAXLINESIZE) {
linelen = 0;
if (crlf)
- odatalen += 3;
+ delta += 3;
else
- odatalen += 2;
+ delta += 2;
}
linelen++;
- odatalen++;
+ delta++;
in++;
}
}
+ if (PY_SSIZE_T_MAX - delta < odatalen) {
+ PyErr_NoMemory();
+ return NULL;
+ }
+ odatalen += delta;
}
/* We allocate the output same size as input, this is overkill.