Three issues in Python have been reported:
Justin Ferguson: Multiple buffer overflows in unicode processing
The unicode_resize() function acts essentially as a wrapper to
realloc(), it accomplishes this via the PyMem_RESIZE() macro which
factors the size with the size of the type, in this case it multiplies
by two as Py_UNICODE is typedef'd to a wchar_t. When resizing large
strings, this results in an incorrect allocation that in turn leads to
Proposed patch: http://bugs.python.org/file10825/issue2620-gps02-patch.txt
Only affects 32 bit systems.
"Google integer overflows"
Added checks for integer overflows, contributed by Google. Some are
only available if asserts are left in the code, in cases where they
can't be triggered from Python code.
Fixes are in 2.5.2.
Justin Ferguson PyOS integer underflow/overflow
Fix potential integer underflow and overflow conditions in
the PyOS_vsnprintf C API function.
This is a backport of r63728 and r63734 from trunk.
Fix issue2589: there was a potential integer overflow leading to
memory corruption on esoteric platforms and incorrect behavior on
Fix issue2588: Do not execute str[size-1] = '\0' when a 0 size is
passed in. (The assert won't prevent this in non-debug builds).
Created attachment 160679 [details, diff]
Created attachment 161577 [details, diff]
Created attachment 161579 [details, diff]
Fixed together with the patches from bug #230640