This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: alp_readsamps() overflow leads to memory corruption in ?unused? SGI extension module almodule.c
Type: security Stage: resolved
Components: Extension Modules Versions: Python 2.5
process
Status: closed Resolution: wont fix
Dependencies: Superseder:
Assigned To: Nosy List: jnferguson, r.david.murray
Priority: normal Keywords:

Created on 2008-04-08 16:31 by jnferguson, last changed 2022-04-11 14:56 by admin. This issue is now closed.

Messages (2)
msg65188 - (view) Author: Justin Ferguson (jnferguson) Date: 2008-04-08 16:31
You guys should probably just remove the SGI modules, the code looks
like it hasn't been touched in some time and hasn't gone through the
same security checks as other pieces of code. Sorry I have no
repro's/pocs, I don't have an irix box either though ;]

integer overflow/misallocation occurs at 1071, write to bad memory at 1076

1042 alp_readsamps(alpobject *self, PyObject *args)
1043 {
1044         long count;
1045         PyObject *v;
1046         ALconfig c;
1047         int width;
1048         int ret;
1049 
1050         if (!PyArg_ParseTuple(args, "l:readsamps", &count))
1051                 return NULL;
1052 
1053         if (count <= 0) {
1054                 PyErr_SetString(ErrorObject, "al.readsamps : arg <=
0");
1055                 return NULL;
1056         }
1057 
1058         c = ALgetconfig(self->port);
1059 #ifdef AL_405
1060         width = ALgetsampfmt(c);
1061         if (width == AL_SAMPFMT_FLOAT)
1062                 width = sizeof(float);
1063         else if (width == AL_SAMPFMT_DOUBLE)
1064                 width = sizeof(double);
1065         else
1066                 width = ALgetwidth(c);
1067 #else
1068         width = ALgetwidth(c);
1069 #endif /* AL_405 */
1070         ALfreeconfig(c);
1071         v = PyString_FromStringAndSize((char *)NULL, width * count);
1072         if (v == NULL)
1073                 return NULL;
1074 
1075         Py_BEGIN_ALLOW_THREADS
1076         ret = ALreadsamps(self->port, (void *)
PyString_AsString(v), count);
1077         Py_END_ALLOW_THREADS
1078         if (ret == -1) {
1079                 Py_DECREF(v);
1080                 return NULL;
1081         }
1082 
1083         return (v);
1084 }
msg84399 - (view) Author: R. David Murray (r.david.murray) * (Python committer) Date: 2009-03-29 14:01
closed per comments in issue2591.
History
Date User Action Args
2022-04-11 14:56:33adminsetgithub: 46846
2009-03-29 14:01:30r.david.murraysetstatus: open -> closed

nosy: + r.david.murray
messages: + msg84399

resolution: wont fix
stage: resolved
2008-04-08 16:31:43jnfergusoncreate