Attachment #159424 for bug #230640

Lines 525-531 Link Here

(-)Modules/bz2module.c (-1 / +1 lines)
525	buffersize = Util_NewBufferSize((size_t)0);	525	buffersize = Util_NewBufferSize((size_t)0);
526	else	526	else
527	buffersize = bytesrequested;	527	buffersize = bytesrequested;
528	if (buffersize > INT_MAX) {	528	if (buffersize > PY_SSIZE_T_MAX) {
529	PyErr_SetString(PyExc_OverflowError,	529	PyErr_SetString(PyExc_OverflowError,
530	"requested number of bytes is "	530	"requested number of bytes is "
531	"more than a Python string can hold");	531	"more than a Python string can hold");




	long bytesrequested = -1;
	size_t bytesread, buffersize, chunksize;
	PyObject *v;

	if (f->f_fp == NULL)
		return err_closed();
	/* refuse to mix with f.next() */

		buffersize = new_buffersize(f, (size_t)0);
	else
		buffersize = bytesrequested;

	if (buffersize > PY_SSIZE_T_MAX) {
		PyErr_SetString(PyExc_OverflowError,
	"requested number of bytes is more than a Python string can hold");

	 * into its buffer.
	 */
	total_v_size = MAXBUFSIZE << 1;
	v = PyString_FromStringAndSize((char*)NULL, total_v_size);
	if (v == NULL)
		return v;
	/* copy over everything except the last null byte */

			Py_DECREF(v);
			return NULL;
		}
		if (_PyString_Resize(&v, (Py_ssize_t)total_v_size) < 0)
			return NULL;
		/* overwrite the trailing null byte */
		pvfree = BUF(v) + (prev_v_size - 1);

Return to bug 230640

Lines 831-837 Link Here

(-)Objects/fileobject.c (-3 / +3 lines)
831	long bytesrequested = -1;	831	long bytesrequested = -1;
832	size_t bytesread, buffersize, chunksize;	832	size_t bytesread, buffersize, chunksize;
833	PyObject *v;	833	PyObject *v;
834
835	if (f->f_fp == NULL)	834	if (f->f_fp == NULL)
836	return err_closed();	835	return err_closed();
837	/* refuse to mix with f.next() */	836	/* refuse to mix with f.next() */
Lines 845-850 Link Here
845	buffersize = new_buffersize(f, (size_t)0);	844	buffersize = new_buffersize(f, (size_t)0);
846	else	845	else
847	buffersize = bytesrequested;	846	buffersize = bytesrequested;
		847
848	if (buffersize > PY_SSIZE_T_MAX) {	848	if (buffersize > PY_SSIZE_T_MAX) {
849	PyErr_SetString(PyExc_OverflowError,	849	PyErr_SetString(PyExc_OverflowError,
850	"requested number of bytes is more than a Python string can hold");	850	"requested number of bytes is more than a Python string can hold");
Lines 1075-1081 Link Here
1075	* into its buffer.	1075	* into its buffer.
1076	*/	1076	*/
1077	total_v_size = MAXBUFSIZE << 1;	1077	total_v_size = MAXBUFSIZE << 1;
1078	v = PyString_FromStringAndSize((char*)NULL, (int)total_v_size);	1078	v = PyString_FromStringAndSize((char*)NULL, total_v_size);
1079	if (v == NULL)	1079	if (v == NULL)
1080	return v;	1080	return v;
1081	/* copy over everything except the last null byte */	1081	/* copy over everything except the last null byte */
Lines 1130-1136 Link Here
1130	Py_DECREF(v);	1130	Py_DECREF(v);
1131	return NULL;	1131	return NULL;
1132	}	1132	}
1133	if (_PyString_Resize(&v, (int)total_v_size) < 0)	1133	if (_PyString_Resize(&v, (Py_ssize_t)total_v_size) < 0)
1134	return NULL;	1134	return NULL;
1135	/* overwrite the trailing null byte */	1135	/* overwrite the trailing null byte */
1136	pvfree = BUF(v) + (prev_v_size - 1);	1136	pvfree = BUF(v) + (prev_v_size - 1);