Skip to content

Commit acaafa4

Browse files
vstinnermiss-islington
authored andcommitted
pythongh-156939: Fix struct.pack('0p', bytes) (pythonGH-157071)
If the Pascal string is empty (size=0), do not write the size prefix. Previously, a NUL byte was written outsize the buffer (buffer overflow). In practice, the write remains into allocated memory and is silently ignored: no memory is corrupted. (cherry picked from commit 23525c9) Co-authored-by: Victor Stinner <vstinner@python.org>
1 parent 3d16dc6 commit acaafa4

1 file changed

Lines changed: 3 additions & 1 deletion

File tree

Modules/_struct.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2395,7 +2395,9 @@ s_pack_internal(PyStructObject *soself, PyObject *const *args,
23952395
memcpy(res + 1, p, n);
23962396
if (n > 255)
23972397
n = 255;
2398-
*res = Py_SAFE_DOWNCAST(n, Py_ssize_t, unsigned char);
2398+
if (n > 0) {
2399+
*res = Py_SAFE_DOWNCAST(n, Py_ssize_t, unsigned char);
2400+
}
23992401
} else {
24002402
if (e->pack(state, res, v, e) < 0) {
24012403
if (PyLong_Check(v) && PyErr_ExceptionMatches(PyExc_OverflowError))

0 commit comments

Comments
 (0)