This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: memory access before short string when checking suffix
Type: Stage:
Components: Interpreter Core Versions: Python 2.6, Python 2.5
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: doko Nosy List: doko, ralph.corderoy
Priority: normal Keywords:

Created on 2008-09-12 12:11 by doko, last changed 2022-04-11 14:56 by admin. This issue is now closed.

Messages (2)
msg73083 - (view) Author: Matthias Klose (doko) * (Python committer) Date: 2008-09-12 12:11
forwarded from https://launchpad.net/bugs/234798

Bug reporter writes:

Python/pythonrun.c's PyRun_SimpleFileExFlags() assumes the filename's
extension
starts four characters back from the end. But what if the filename is
only one
character long? Memory before the filename is referenced which is probably
outside the memory allocated for the string. Here's the relevant bits of
code,
boring lines deleted.

    int
    PyRun_SimpleFileExFlags(FILE *fp, const char *filename, int closeit,
                            PyCompilerFlags *flags)
    {
        ext = filename + strlen(filename) - 4;
        if (maybe_pyc_file(fp, filename, ext, closeit)) {
            if (strcmp(ext, ".pyo") == 0)
                Py_OptimizeFlag = 1;
    }

    static int
    maybe_pyc_file(FILE *fp, const char* filename, const char* ext, int
closeit)
    {
        if (strcmp(ext, ".pyc") == 0 || strcmp(ext, ".pyo") == 0)
            return 1;
    }

A trivial solution is:

    len = strlen(filename);
    ext = filename + len - len > 4 ? 4 : 0;

This will make ext point to the NUL terminator unless filename has room
for the desired /\.py[co]$/ suffix *and* at least one character
beforehand, since I don't suppose it's intended that ".pyo" is a valid
pyo file.
msg85397 - (view) Author: Matthias Klose (doko) * (Python committer) Date: 2009-04-04 14:34
fixed for 2.7, 2.6, 3.1
History
Date User Action Args
2022-04-11 14:56:39adminsetgithub: 48095
2009-04-04 14:34:04dokosetstatus: open -> closed
assignee: doko
resolution: fixed
messages: + msg85397
2008-09-13 10:53:25ralph.corderoysetnosy: + ralph.corderoy
2008-09-12 12:11:40dokocreate