Attachment #159426 for bug #230640

Lines 525-531 Link Here

(-)Modules/bz2module.c (-1 / +1 lines)
525	buffersize = Util_NewBufferSize((size_t)0);	525	buffersize = Util_NewBufferSize((size_t)0);
526	else	526	else
527	buffersize = bytesrequested;	527	buffersize = bytesrequested;
528	if (buffersize > INT_MAX) {	528	if (buffersize > PY_SSIZE_T_MAX) {
529	PyErr_SetString(PyExc_OverflowError,	529	PyErr_SetString(PyExc_OverflowError,
530	"requested number of bytes is "	530	"requested number of bytes is "
531	"more than a Python string can hold");	531	"more than a Python string can hold");




	long bytesrequested = -1;
	size_t bytesread, buffersize, chunksize;
	PyObject *v;

	if (f->f_fp == NULL)
		return err_closed();
	/* refuse to mix with f.next() */

		buffersize = new_buffersize(f, (size_t)0);
	else
		buffersize = bytesrequested;

	if (buffersize > PY_SSIZE_T_MAX) {
		PyErr_SetString(PyExc_OverflowError,
	"requested number of bytes is more than a Python string can hold");

	 * into its buffer.
	 */
	total_v_size = MAXBUFSIZE << 1;
	v = PyString_FromStringAndSize((char*)NULL, total_v_size);
	if (v == NULL)
		return v;
	/* copy over everything except the last null byte */

			Py_DECREF(v);
			return NULL;
		}
		if (_PyString_Resize(&v, (Py_ssize_t)total_v_size) < 0)
			return NULL;
		/* overwrite the trailing null byte */
		pvfree = BUF(v) + (prev_v_size - 1);

Return to bug 230640

Lines 939-945 Link Here

(-)Objects/fileobject.c (-3 / +3 lines)
939	long bytesrequested = -1;	939	long bytesrequested = -1;
940	size_t bytesread, buffersize, chunksize;	940	size_t bytesread, buffersize, chunksize;
941	PyObject *v;	941	PyObject *v;
942
943	if (f->f_fp == NULL)	942	if (f->f_fp == NULL)
944	return err_closed();	943	return err_closed();
945	/* refuse to mix with f.next() */	944	/* refuse to mix with f.next() */
Lines 953-958 Link Here
953	buffersize = new_buffersize(f, (size_t)0);	952	buffersize = new_buffersize(f, (size_t)0);
954	else	953	else
955	buffersize = bytesrequested;	954	buffersize = bytesrequested;
		955
956	if (buffersize > PY_SSIZE_T_MAX) {	956	if (buffersize > PY_SSIZE_T_MAX) {
957	PyErr_SetString(PyExc_OverflowError,	957	PyErr_SetString(PyExc_OverflowError,
958	"requested number of bytes is more than a Python string can hold");	958	"requested number of bytes is more than a Python string can hold");
Lines 1183-1189 Link Here
1183	* into its buffer.	1183	* into its buffer.
1184	*/	1184	*/
1185	total_v_size = MAXBUFSIZE << 1;	1185	total_v_size = MAXBUFSIZE << 1;
1186	v = PyString_FromStringAndSize((char*)NULL, (int)total_v_size);	1186	v = PyString_FromStringAndSize((char*)NULL, total_v_size);
1187	if (v == NULL)	1187	if (v == NULL)
1188	return v;	1188	return v;
1189	/* copy over everything except the last null byte */	1189	/* copy over everything except the last null byte */
Lines 1238-1244 Link Here
1238	Py_DECREF(v);	1238	Py_DECREF(v);
1239	return NULL;	1239	return NULL;
1240	}	1240	}
1241	if (_PyString_Resize(&v, (int)total_v_size) < 0)	1241	if (_PyString_Resize(&v, (Py_ssize_t)total_v_size) < 0)
1242	return NULL;	1242	return NULL;
1243	/* overwrite the trailing null byte */	1243	/* overwrite the trailing null byte */
1244	pvfree = BUF(v) + (prev_v_size - 1);	1244	pvfree = BUF(v) + (prev_v_size - 1);