py/objstringio: Prevent offset wraparound for io.BytesIO objects.

Too big positive, or too big negative offset values could lead to overflow
and address space wraparound and thus access to unrelated areas of memory
(a security issue).
crypto-aes
Tom Collins 6 years ago committed by Paul Sokolovsky
parent 387a8d26f9
commit 168350cd98

@ -125,8 +125,19 @@ STATIC mp_uint_t stringio_ioctl(mp_obj_t o_in, mp_uint_t request, uintptr_t arg,
ref = o->vstr->len;
break;
}
o->pos = ref + s->offset;
s->offset = o->pos;
mp_uint_t new_pos = ref + s->offset;
if (s->offset < 0) {
if (new_pos > ref) {
// Negative offset from SEEK_CUR or SEEK_END went past 0.
// CPython sets position to 0, POSIX returns an EINVAL error
new_pos = 0;
}
} else if (new_pos < ref) {
// positive offset went beyond the limit of mp_uint_t
*errcode = MP_EINVAL; // replace with MP_EOVERFLOW when defined
return MP_STREAM_ERROR;
}
s->offset = o->pos = new_pos;
return 0;
}
case MP_STREAM_FLUSH:

Loading…
Cancel
Save