From 55f33240f3d7051d4213629e92437a36f1fac50e Mon Sep 17 00:00:00 2001 From: Alexander Steffen Date: Fri, 30 Jun 2017 09:22:17 +0200 Subject: all: Use the name MicroPython consistently in comments There were several different spellings of MicroPython present in comments, when there should be only one. --- py/objstringio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'py/objstringio.c') diff --git a/py/objstringio.c b/py/objstringio.c index 645c441cb..046d32580 100644 --- a/py/objstringio.c +++ b/py/objstringio.c @@ -1,5 +1,5 @@ /* - * This file is part of the Micro Python project, http://micropython.org/ + * This file is part of the MicroPython project, http://micropython.org/ * * The MIT License (MIT) * -- cgit v1.2.3 From 168350cd9849b0ab56867c487cfd78ca68c2b228 Mon Sep 17 00:00:00 2001 From: Tom Collins Date: Thu, 25 May 2017 13:53:49 -0700 Subject: py/objstringio: Prevent offset wraparound for io.BytesIO objects. Too big positive, or too big negative offset values could lead to overflow and address space wraparound and thus access to unrelated areas of memory (a security issue). --- py/objstringio.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) (limited to 'py/objstringio.c') diff --git a/py/objstringio.c b/py/objstringio.c index 046d32580..cb8003bcd 100644 --- a/py/objstringio.c +++ b/py/objstringio.c @@ -125,8 +125,19 @@ STATIC mp_uint_t stringio_ioctl(mp_obj_t o_in, mp_uint_t request, uintptr_t arg, ref = o->vstr->len; break; } - o->pos = ref + s->offset; - s->offset = o->pos; + mp_uint_t new_pos = ref + s->offset; + if (s->offset < 0) { + if (new_pos > ref) { + // Negative offset from SEEK_CUR or SEEK_END went past 0. + // CPython sets position to 0, POSIX returns an EINVAL error + new_pos = 0; + } + } else if (new_pos < ref) { + // positive offset went beyond the limit of mp_uint_t + *errcode = MP_EINVAL; // replace with MP_EOVERFLOW when defined + return MP_STREAM_ERROR; + } + s->offset = o->pos = new_pos; return 0; } case MP_STREAM_FLUSH: -- cgit v1.2.3 From 0cd9ab77550eada4def492a3a25286ead71a3b24 Mon Sep 17 00:00:00 2001 From: Paul Sokolovsky Date: Sun, 20 Aug 2017 21:32:17 +0300 Subject: py/objstringio: Fix regression with handling SEEK_SET. For SEEK_SET, offset should be treated as unsigned, to allow full-width stream sizes (e.g. 32-bit instead of 31-bit). This is now fully documented in stream.h. Also, seek symbolic constants are added. --- py/objstringio.c | 8 +++++--- py/stream.h | 8 ++++++++ 2 files changed, 13 insertions(+), 3 deletions(-) (limited to 'py/objstringio.c') diff --git a/py/objstringio.c b/py/objstringio.c index cb8003bcd..61da0203e 100644 --- a/py/objstringio.c +++ b/py/objstringio.c @@ -118,15 +118,17 @@ STATIC mp_uint_t stringio_ioctl(mp_obj_t o_in, mp_uint_t request, uintptr_t arg, struct mp_stream_seek_t *s = (struct mp_stream_seek_t*)arg; mp_uint_t ref = 0; switch (s->whence) { - case 1: // SEEK_CUR + case MP_SEEK_CUR: ref = o->pos; break; - case 2: // SEEK_END + case MP_SEEK_END: ref = o->vstr->len; break; } mp_uint_t new_pos = ref + s->offset; - if (s->offset < 0) { + + // For MP_SEEK_SET, offset is unsigned + if (s->whence != MP_SEEK_SET && s->offset < 0) { if (new_pos > ref) { // Negative offset from SEEK_CUR or SEEK_END went past 0. // CPython sets position to 0, POSIX returns an EINVAL error diff --git a/py/stream.h b/py/stream.h index 401ae313c..fbe3d7d85 100644 --- a/py/stream.h +++ b/py/stream.h @@ -50,10 +50,18 @@ // Argument structure for MP_STREAM_SEEK struct mp_stream_seek_t { + // If whence == MP_SEEK_SET, offset should be treated as unsigned. + // This allows dealing with full-width stream sizes (16, 32, 64, + // etc. bits). For other seek types, should be treated as signed. mp_off_t offset; int whence; }; +// seek ioctl "whence" values +#define MP_SEEK_SET (0) +#define MP_SEEK_CUR (1) +#define MP_SEEK_END (2) + MP_DECLARE_CONST_FUN_OBJ_VAR_BETWEEN(mp_stream_read_obj); MP_DECLARE_CONST_FUN_OBJ_VAR_BETWEEN(mp_stream_read1_obj); MP_DECLARE_CONST_FUN_OBJ_VAR_BETWEEN(mp_stream_readinto_obj); -- cgit v1.2.3