gh-155742: Use PyMem_Malloc() in decode_unicode_with_escapes() - #157587
Conversation
PyWriterWriter_Finish() is not called, the writer is always discarded. It's just used as a temporary buffer. Add non-ASCII tests to test_string_literals.
|
@lysnikolaou @pablogsal: I was surprised that test_string_literals has no test on non-ASCII string. Is it on purpose? The test docstring says:
|
Hummmm I don't think this is on purpose :( |
Oh ok. Well, my PR adds some tests on Unicode characters :) |
| return NULL; | ||
| } | ||
| p = buf = PyBytes_AsString(u); | ||
| p = buf = PyBytesWriter_GetData(writer); |
There was a problem hiding this comment.
Oh good idea, there is no need for PyBytesWriter since there is no resize and no bytes object is ever needed. I pushed a change to just use PyMem_Malloc(). In debug mode, PyMem_Malloc() detects buffer overflow so I'm fine with it :-)
Replace soft deprecated PyBytes_FromStringAndSize(NULL, size) with a simple PyMem_Malloc(). Avoid also "s = buf" to make the code easier to follow (and easier to debug).
|
I removed the "Add +1 to allow writing a trailing null byte (for strcpy/sprintf)" and replaced it with an assertion to make sure that the buffer is large enough to write a null byte. I ran the test suite without this "+1" and no buffer overflow has been detected. |
vstinner
changed the title
3 participants
Replace soft deprecated PyBytes_FromStringAndSize(NULL, size) with a simple PyMem_Malloc().
Avoid also "s = buf" to make the code easier to follow (and easier to debug).
Add non-ASCII tests to test_string_literals.