[issue24467] bytearray pop and remove Buffer Over-read
Changes by Arfrever Frehtes Taifersar Arahesis arfrever@gmail.com: -- nosy: +Arfrever ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
Changes by Serhiy Storchaka storch...@gmail.com: -- components: +Interpreter Core resolution: - fixed stage: patch review - resolved status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
Roundup Robot added the comment: New changeset a887ce8611d2 by Serhiy Storchaka in branch '2.7': Issue #24467: Fixed possible buffer over-read in bytearray. The bytearray https://hg.python.org/cpython/rev/a887ce8611d2 New changeset c95d7ffa492e by Serhiy Storchaka in branch '3.4': Issue #24467: Fixed possible buffer over-read in bytearray. The bytearray https://hg.python.org/cpython/rev/c95d7ffa492e New changeset 942860bada14 by Serhiy Storchaka in branch '3.5': Issue #24467: Fixed possible buffer over-read in bytearray. The bytearray https://hg.python.org/cpython/rev/942860bada14 New changeset 97a24bc714ec by Serhiy Storchaka in branch 'default': Issue #24467: Fixed possible buffer over-read in bytearray. The bytearray https://hg.python.org/cpython/rev/97a24bc714ec -- nosy: +python-dev ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
Serhiy Storchaka added the comment: The bytearray object allocates one byte more for trailing null byte. ob_size always should be less than ob_alloc if ob_alloc != 0. But in rare cases when the bytearray is initialized with an iterator, this rule can be violated. Following patch restores this property. PyByteArray_AS_STRING() now always returns null-terminated string. -- Added file: http://bugs.python.org/file39826/bytearray_init_trailing_null.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
Changes by Serhiy Storchaka storch...@gmail.com: -- assignee: - serhiy.storchaka stage: - patch review versions: +Python 3.4, Python 3.5, Python 3.6 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
DmitryJ added the comment: If this is the case, then issue24462 should be fixed by this patch as well. I'm sorry about missing the root cause here. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
Changes by DmitryJ ga...@tut.by: Added file: http://bugs.python.org/file39781/issue24467-3.2.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
DmitryJ added the comment: Attached is a patch that fixes the reported issue. Since there are no visible side effects in Python, I could not write a test for this. -- keywords: +patch Added file: http://bugs.python.org/file39780/issue24467-2.7.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
Changes by DmitryJ ga...@tut.by: Added file: http://bugs.python.org/file39783/issue24467-3.4.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
Changes by DmitryJ ga...@tut.by: Added file: http://bugs.python.org/file39784/issue24467-3.5.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
Changes by DmitryJ ga...@tut.by: Added file: http://bugs.python.org/file39782/issue24467-3.3.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
DmitryJ added the comment: Offending code in 2.7: https://hg.python.org/cpython/file/20c9290a5de4/Objects/bytearrayobject.c#l2381 https://hg.python.org/cpython/file/20c9290a5de4/Objects/bytearrayobject.c#l2412 Let n = 16, where = 0; memmove() then attempts to copy (n - where) = 16 bytes where it should have copied 15, since we drop one. This appears to be a typical case of off-by-one. Changing (n - where) to (n - where - 1) should fix the issue. This underfows when (where + 1) n, but this case is guarded against in bytearray_pop() and cannot occur in bytearray_remove(). The exact same memmove() invocation code is found in all 3.x branches as well. -- nosy: +dev_zzo ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
Changes by Serhiy Storchaka storch...@gmail.com: -- nosy: +serhiy.storchaka ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24467] bytearray pop and remove Buffer Over-read
Changes by Ned Deily n...@acm.org: -- nosy: +benjamin.peterson ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24467 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
