Handle error cases of PySequence_Length() and PySequence_GetItem(). Add an test case for zero length CA.
diff --git a/src/crypto/pkcs12.c b/src/crypto/pkcs12.c
index 7a6a95c..6f1b697 100644
--- a/src/crypto/pkcs12.c
+++ b/src/crypto/pkcs12.c
@@ -139,18 +139,21 @@
{
PyObject *cacerts;
static char *kwlist[] = {"cacerts", NULL};
- int i; /* Py_ssize_t for Python 2.5+ */
+ int i, len; /* Py_ssize_t for Python 2.5+ */
if (!PyArg_ParseTupleAndKeywords(args, keywds, "O:set_ca_certificates",
kwlist, &cacerts))
return NULL;
if (cacerts == Py_None) {
/* We are good. */
- } else if (PySequence_Check(cacerts)) { /* is iterable */
+ } else if ((len = PySequence_Length(cacerts)) >= 0) { /* is iterable */
/* Check is's a simple list filled only with X509 objects. */
- for(i = 0;i < PySequence_Length(cacerts);i++) { /* For each CA cert */
+ for(i = 0;i < len;i++) { /* For each CA cert */
PyObject *obj;
obj = PySequence_GetItem(cacerts, i);
+ if(obj == NULL) {
+ break;
+ }
if (PyObject_Type(obj) != (PyObject *) &crypto_X509_Type) {
Py_DECREF(obj);
PyErr_SetString(PyExc_TypeError, "cacerts iterable must only contain X509Type");