Index: Python/marshal.c =================================================================== --- Python/marshal.c (revision 75105) +++ Python/marshal.c (working copy) @@ -556,7 +556,7 @@ r_PyLong(RFILE *p) { PyLongObject *ob; - int size, i, j, md; + int size, i, j, md, shorts_in_top_digit; long n; digit d; @@ -586,12 +586,22 @@ ob->ob_digit[i] = d; } d = 0; - for (j=0; j < (ABS(n)-1)%PyLong_MARSHAL_RATIO + 1; j++) { + shorts_in_top_digit = (ABS(n)-1) % PyLong_MARSHAL_RATIO + 1; + for (j=0; j < shorts_in_top_digit; j++) { md = r_short(p); if (md < 0 || md > PyLong_MARSHAL_BASE) goto bad_digit; + /* topmost marshal digit should be nonzero */ + if (md == 0 && j == shorts_in_top_digit - 1) { + Py_DECREF(ob); + PyErr_SetString(PyExc_ValueError, + "bad marshal data (unnormalized long data)"); + return NULL; + } d += (digit)md << j*PyLong_MARSHAL_SHIFT; } + /* top digit should be nonzero, else the resulting PyLong won't be + normalized */ ob->ob_digit[size-1] = d; return (PyObject *)ob; bad_digit: Index: Lib/test/test_marshal.py =================================================================== --- Lib/test/test_marshal.py (revision 75105) +++ Lib/test/test_marshal.py (working copy) @@ -262,7 +262,12 @@ testString = 'abc' * size marshal.dumps(testString) + def test_invalid_longs(self): + # Issue #7019: marshal.loads shouldn't produce unnormalized PyLongs + invalid_string = 'l\x02\x00\x00\x00\x00\x00\x00\x00' + self.assertRaises(ValueError, marshal.loads, invalid_string) + def test_main(): test_support.run_unittest(IntTestCase, FloatTestCase,