The zlib module in multiple places fails to adequately check the sanity
of its arguments resulting in memory corruption, please see two attached
PoCs.

Verified that the script crashes Python.

Just so you know, the scripts actually do two different things-- the
bugs are both related to negative values though. One causes
PyString_FromStringAndSize() to try an allocate zero bytes (the -24
one), the other causes like 22 bytes to get allocated and then takes
advantage of the sign-conversion when the value is assigned to the zlib
structure member (the member is unsigned, the value is signed)

Honestly, you guys should consider enforcing the safe downcast usage
because signedness issues are all over your code base (as I'm sure you know)

This has just been fixed in the trunk: r62235.

Thx

I submit that a check for negative values (non-assert-based) should be 
added to PyString_FromStringAndSize(). This API is called from many, many 
places, and in several cases the operand could probably be negative. It 
should raise an overflow exception for a negative value.

On Thu, Apr 10, 2008 at 1:17 PM, David Remahl <report@bugs.python.org> wrote:

>  I submit that a check for negative values (non-assert-based) should be
>  added to PyString_FromStringAndSize().

See issue2587 and r62262.