RetroSearch Browse

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://github.com/python/cpython/commit/93ebfb154456daa841aa223bd296422787b3074c below:

[CVE-2007-4965] Integer overflow in imageop module. · python/cpython@93ebfb1 · GitHub


 @@ -78,7 +78,7 @@ imageop_crop(PyObject *self, PyObject *args)

78 78


 char *cp, *ncp;

79 79


 short *nsp;

80 80


 Py_Int32 *nlp;

81

-
 int len, size, x, y, newx1, newx2, newy1, newy2;

81

+
 int len, size, x, y, newx1, newx2, newy1, newy2, nlen;

82 82


 int ix, iy, xstep, ystep;

83 83


 PyObject *rv;

84 84


 @@ -90,13 +90,19 @@ imageop_crop(PyObject *self, PyObject *args)

90 90


 PyErr_SetString(ImageopError, "Size should be 1, 2 or 4");

91 91


 return 0;

92 92

93

-
 if ( len != size*x*y ) {

93

+
 if (( len != size*x*y ) ||

94

+
 ( size != ((len / x) / y) )) {

94 95


 PyErr_SetString(ImageopError, "String has incorrect length");

95 96


 return 0;

96 97

97 98


 xstep = (newx1 < newx2)? 1 : -1;

98 99


 ystep = (newy1 < newy2)? 1 : -1;

99 100 101

+
 nlen = (abs(newx2-newx1)+1)*(abs(newy2-newy1)+1)*size;

102

+
 if ( size != ((nlen / (abs(newx2-newx1)+1)) / (abs(newy2-newy1)+1)) ) {

103

+
 PyErr_SetString(ImageopError, "String has incorrect length");

104

+
 return 0;

105

+
 }

100 106


 rv = PyString_FromStringAndSize(NULL,

101 107


 (abs(newx2-newx1)+1)*(abs(newy2-newy1)+1)*size);

102 108


 if ( rv == 0 )


 @@ -132,7 +138,7 @@ imageop_scale(PyObject *self, PyObject *args)

132 138


 char *cp, *ncp;

133 139


 short *nsp;

134 140


 Py_Int32 *nlp;

135

-
 int len, size, x, y, newx, newy;

141

+
 int len, size, x, y, newx, newy, nlen;

136 142


 int ix, iy;

137 143


 int oix, oiy;

138 144


 PyObject *rv;


 @@ -145,12 +151,18 @@ imageop_scale(PyObject *self, PyObject *args)

145 151


 PyErr_SetString(ImageopError, "Size should be 1, 2 or 4");

146 152


 return 0;

147 153

148

-
 if ( len != size*x*y ) {

154

+
 if ( ( len != size*x*y ) ||

155

+
 ( size != ((len / x) / y) ) ) {

156

+
 PyErr_SetString(ImageopError, "String has incorrect length");

157

+
 return 0;

158

+
 }

159

+
 nlen = newx*newy*size;

160

+
 if ( size != ((nlen / newx) / newy) ) {

149 161


 PyErr_SetString(ImageopError, "String has incorrect length");

150 162


 return 0;

151 163

152 164 153

-
 rv = PyString_FromStringAndSize(NULL, newx*newy*size);

165

+
 rv = PyString_FromStringAndSize(NULL, nlen);

154 166


 if ( rv == 0 )

155 167


 return 0;

156 168


 ncp = (char *)PyString_AsString(rv);


 @@ -190,7 +202,8 @@ imageop_tovideo(PyObject *self, PyObject *args)

190 202


 PyErr_SetString(ImageopError, "Size should be 1 or 4");

191 203


 return 0;

192 204

193

-
 if ( maxx*maxy*width != len ) {

205

+
 if ( ( maxx*maxy*width != len ) ||

206

+
 ( maxx != ((len / maxy) / width) ) ) {

194 207


 PyErr_SetString(ImageopError, "String has incorrect length");

195 208


 return 0;

196 209


 @@ -240,7 +253,8 @@ imageop_grey2mono(PyObject *self, PyObject *args)

240 253


 if ( !PyArg_ParseTuple(args, "s#iii", &cp, &len, &x, &y, &tres) )

241 254


 return 0;

242 255 243

-
 if ( x*y != len ) {

256

+
 if ( ( x*y != len ) ||

257

+
 ( x != len / y ) ) {

244 258


 PyErr_SetString(ImageopError, "String has incorrect length");

245 259


 return 0;

246 260


 @@ -281,7 +295,8 @@ imageop_grey2grey4(PyObject *self, PyObject *args)

281 295


 if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) )

282 296


 return 0;

283 297 284

-
 if ( x*y != len ) {

298

+
 if ( ( x*y != len ) ||

299

+
 ( x != len / y ) ) {

285 300


 PyErr_SetString(ImageopError, "String has incorrect length");

286 301


 return 0;

287 302


 @@ -320,7 +335,8 @@ imageop_grey2grey2(PyObject *self, PyObject *args)

320 335


 if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) )

321 336


 return 0;

322 337 323

-
 if ( x*y != len ) {

338

+
 if ( ( x*y != len ) ||

339

+
 ( x != len / y ) ) {

324 340


 PyErr_SetString(ImageopError, "String has incorrect length");

325 341


 return 0;

326 342


 @@ -358,7 +374,8 @@ imageop_dither2mono(PyObject *self, PyObject *args)

358 374


 if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) )

359 375


 return 0;

360 376 361

-
 if ( x*y != len ) {

377

+
 if ( ( x*y != len ) ||

378

+
 ( x != len / y ) ) {

362 379


 PyErr_SetString(ImageopError, "String has incorrect length");

363 380


 return 0;

364 381


 @@ -404,7 +421,8 @@ imageop_dither2grey2(PyObject *self, PyObject *args)

404 421


 if ( !PyArg_ParseTuple(args, "s#ii", &cp, &len, &x, &y) )

405 422


 return 0;

406 423 407

-
 if ( x*y != len ) {

424

+
 if ( ( x*y != len ) ||

425

+
 ( x != len / y ) ) {

408 426


 PyErr_SetString(ImageopError, "String has incorrect length");

409 427


 return 0;

410 428


 @@ -443,7 +461,11 @@ imageop_mono2grey(PyObject *self, PyObject *args)

443 461


 if ( !PyArg_ParseTuple(args, "s#iiii", &cp, &len, &x, &y, &v0, &v1) )

444 462


 return 0;

445 463 446

-
 nlen = x*y;

464

+
 nlen = x*y;

465

+
 if ( x != (nlen / y) ) {

466

+
 PyErr_SetString(ImageopError, "String has incorrect length");

467

+
 return 0;

468

+
 }

447 469


 if ( (nlen+7)/8 != len ) {

448 470


 PyErr_SetString(ImageopError, "String has incorrect length");

449 471


 return 0;


 @@ -481,6 +503,10 @@ imageop_grey22grey(PyObject *self, PyObject *args)

481 503


 return 0;

482 504 483 505


 nlen = x*y;

506

+
 if ( x != (nlen / y) ) {

507

+
 PyErr_SetString(ImageopError, "String has incorrect length");

508

+
 return 0;

509

+
 }

484 510


 if ( (nlen+3)/4 != len ) {

485 511


 PyErr_SetString(ImageopError, "String has incorrect length");

486 512


 return 0;


 @@ -517,6 +543,10 @@ imageop_grey42grey(PyObject *self, PyObject *args)

517 543


 return 0;

518 544 519 545


 nlen = x*y;

546

+
 if ( x != (nlen / y) ) {

547

+
 PyErr_SetString(ImageopError, "String has incorrect length");

548

+
 return 0;

549

+
 }

520 550


 if ( (nlen+1)/2 != len ) {

521 551


 PyErr_SetString(ImageopError, "String has incorrect length");

522 552


 return 0;


 @@ -554,6 +584,10 @@ imageop_rgb2rgb8(PyObject *self, PyObject *args)

554 584


 return 0;

555 585 556 586


 nlen = x*y;

587

+
 if ( x != (nlen / y) ) {

588

+
 PyErr_SetString(ImageopError, "String has incorrect length");

589

+
 return 0;

590

+
 }

557 591


 if ( nlen*4 != len ) {

558 592


 PyErr_SetString(ImageopError, "String has incorrect length");

559 593


 return 0;


 @@ -598,10 +632,19 @@ imageop_rgb82rgb(PyObject *self, PyObject *args)

598 632


 return 0;

599 633 600 634


 nlen = x*y;

635

+
 if ( x != (nlen / y) ) {

636

+
 PyErr_SetString(ImageopError, "String has incorrect length");

637

+
 return 0;

638

+
 }

601 639


 if ( nlen != len ) {

602 640


 PyErr_SetString(ImageopError, "String has incorrect length");

603 641


 return 0;

604 642

643 + 644

+
 if ( nlen / x != y || nlen > INT_MAX / 4) {

645

+
 PyErr_SetString(ImageopError, "Image is too large");

646

+
 return 0;

647

+
 }

605 648 606 649


 rv = PyString_FromStringAndSize(NULL, nlen*4);

607 650


 if ( rv == 0 )


 @@ -648,6 +691,10 @@ imageop_rgb2grey(PyObject *self, PyObject *args)

648 691


 return 0;

649 692 650 693


 nlen = x*y;

694

+
 if ( x != (nlen / y) ) {

695

+
 PyErr_SetString(ImageopError, "String has incorrect length");

696

+
 return 0;

697

+
 }

651 698


 if ( nlen*4 != len ) {

652 699


 PyErr_SetString(ImageopError, "String has incorrect length");

653 700


 return 0;


 @@ -693,10 +740,19 @@ imageop_grey2rgb(PyObject *self, PyObject *args)

693 740


 return 0;

694 741 695 742


 nlen = x*y;

743

+
 if ( x != (nlen / y) ) {

744

+
 PyErr_SetString(ImageopError, "String has incorrect length");

745

+
 return 0;

746

+
 }

696 747


 if ( nlen != len ) {

697 748


 PyErr_SetString(ImageopError, "String has incorrect length");

698 749


 return 0;

699 750

751 + 752

+
 if ( nlen / x != y || nlen > INT_MAX / 4) {

753

+
 PyErr_SetString(ImageopError, "Image is too large");

754

+
 return 0;

755

+
 }

700 756 701 757


 rv = PyString_FromStringAndSize(NULL, nlen*4);

702 758


 if ( rv == 0 )

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4