diff options
| author | Jeff Epler <jepler@gmail.com> | 2020-01-08 09:42:44 -0600 |
|---|---|---|
| committer | Jeff Epler <jepler@gmail.com> | 2020-01-08 09:42:44 -0600 |
| commit | 5baaac55ce2b9fb89c1f395e92f67abb5276ce6f (patch) | |
| tree | a71d4ca56d9aa6ff3d0386e9fa8f8d105805c78a /shared-bindings | |
| parent | 22644d33c93d8aa1e346fc23454a14c6d6c8b1f1 (diff) | |
vstr_init_len: Don't crash if (size_t)-1 is passed
In this unusual case, (len + 1) is zero, the allocation in vstr_init
succeeds (allocating 1 byte), and then the caller is likely to erroneously
access outside the allocated region, for instance with a memset().
This could be triggered with os.urandom(-1) after it was converted to use
mp_obj_new_bytes_of_zeros.
Diffstat (limited to 'shared-bindings')
0 files changed, 0 insertions, 0 deletions