[issue25943] Integer overflow in _bsddb leads to heap corruption

Serhiy Storchaka added the comment: New changeset 041a4ee9456d716dd449d38a5328b82e76f5dbc4 by Serhiy Storchaka (Zackery Spytz) in branch '2.7': bpo-25943: Check for integer overflow in bsddb's DB_join(). (GH-8392)

[issue25943] Integer overflow in _bsddb leads to heap corruption

Change by Zackery Spytz : -- pull_requests: +7920 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue25943] Integer overflow in _bsddb leads to heap corruption

Zackery Spytz added the comment: Integer overflow can also occur in DB_join(). -- ___ Python tracker ___ ___ Python-bugs-list

[issue25943] Integer overflow in _bsddb leads to heap corruption

Change by Serhiy Storchaka : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue25943] Integer overflow in _bsddb leads to heap corruption

Serhiy Storchaka added the comment: New changeset 32522050773c257a5c3c0c8929ba5c64123b53ed by Serhiy Storchaka (Zackery Spytz) in branch '2.7': bpo-25943: Fix potential heap corruption in bsddb's _db_associateCallback() (GH-8337)

[issue25943] Integer overflow in _bsddb leads to heap corruption

Change by Zackery Spytz : -- nosy: +ZackerySpytz ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue25943] Integer overflow in _bsddb leads to heap corruption

Change by Zackery Spytz : -- keywords: +patch pull_requests: +7871 stage: needs patch -> patch review ___ Python tracker ___ ___

[issue25943] Integer overflow in _bsddb leads to heap corruption

Changes by Serhiy Storchaka : -- components: +Extension Modules -Library (Lib) nosy: +lemburg, serhiy.storchaka stage: -> needs patch ___ Python tracker

[issue25943] Integer overflow in _bsddb leads to heap corruption

New submission from Ned Williamson: In function `_db_associateCallback` of the `_bsddb` module, associating two databases with a callback that returns a sufficiently large list will lead to heap corruption due an integer overflow on 32-bit Python. >From `_bsddb.c`: ``` else if