This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Parameters and result of PyList_GetItem() are not validated
Type: performance Stage:
Components: None Versions: Python 2.5.3
process
Status: closed Resolution: not a bug
Dependencies: Superseder:
Assigned To: Nosy List: CWRU_Researcher1, rhettinger
Priority: normal Keywords:

Created on 2008-11-29 17:02 by CWRU_Researcher1, last changed 2022-04-11 14:56 by admin. This issue is now closed.

Messages (2)
msg76604 - (view) Author: Brian Szuter (CWRU_Researcher1) Date: 2008-11-29 17:02
Python-2.5.2/Python/import.c(get_path_importer)
Lines 1079

PyString_Check() is not called on the result of PyList_GetItem() and the
parameters of PyList_GetItem() are not validated before the method is
called.
msg76618 - (view) Author: Raymond Hettinger (rhettinger) * (Python committer) Date: 2008-11-29 18:25
Python/import.c lines: 1078-1082:

	for (j = 0; j < nhooks; j++) {
		PyObject *hook = PyList_GetItem(path_hooks, j);
		if (hook == NULL)
			return NULL;
		importer = PyObject_CallFunctionObjArgs(hook, p, NULL);

The "hook" object is supposed to be a callable, not a string.  The code
for PyList_GetItem() does its own argument checking.
History
Date User Action Args
2022-04-11 14:56:41adminsetgithub: 48713
2008-11-29 18:25:24rhettingersetstatus: open -> closed
resolution: not a bug
messages: + msg76618
nosy: + rhettinger
2008-11-29 17:02:13CWRU_Researcher1create