I just discovered a bug in fromfile where it can segfault if the file
data is corrupted in such a way that the array size is insanely large.
(It was a byte-swapping problem in my own code, but it would be
preferable to get an exception rather than a crash).
It's a simple fix to propagate the "array too large" exception before
trying to dereference the NULL array pointer (ret) in PyArray_FromFile
(see attached patch). But my question is: is this an appropriate fix
for 1.4 (it seems pretty straightforward), or should I only make this to
the trunk?
Mike
--
Michael Droettboom
Science Software Branch
Operations and Engineering Division
Space Telescope Science Institute
Operated by AURA for NASA
Index: ctors.c
===================================================================
--- ctors.c (revision 7992)
+++ ctors.c (working copy)
@@ -3042,6 +3055,10 @@
(next_element) fromfile_next_element,
(skip_separator) fromfile_skip_separator, NULL);
}
+ if (ret == NULL) {
+ Py_DECREF(dtype);
+ return NULL;
+ }
if (((intp) nread) < num) {
/* Realloc memory for smaller number of elements */
const size_t nsize = NPY_MAX(nread,1)*ret->descr->elsize;
_______________________________________________
NumPy-Discussion mailing list
[email protected]
http://mail.scipy.org/mailman/listinfo/numpy-discussion
