Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[3.4] bpo-33001: Prevent buffer overrun in os.symlink (GH-5989) #5992

Merged
merged 4 commits into from May 14, 2018

Conversation

@zooba
Copy link
Member

@zooba zooba commented Mar 5, 2018

@zooba
Copy link
Member Author

@zooba zooba commented Mar 5, 2018

@larryhastings FYI, but I'm still testing this one (don't keep VS 2010 handy these days, so it'll be a few hours). Don't rush to merge it

@zooba
Copy link
Member Author

@zooba zooba commented Mar 5, 2018

So I'm skipping the test on 3.4, because the (older) CRT will abort the process on a buffer overrun with the newer methods. I've confirmed that it's definitely a safe abort, but we don't have any way to do this within the process or test suite, so skipping the test but leaving it in there as a reference seems like the best option.

@zooba zooba changed the title [3.4] bpo-33001: Minimal fix to prevent buffer overrun in os.symlink (GH-5989) [3.4] bpo-33001: Prevent buffer overrun in os.symlink (GH-5989) Mar 5, 2018
}

/* Is this path absolute? */
static int
_is_absW(const WCHAR *path)
{
return path[0] == L'\\' || path[0] == L'/' || path[1] == L':';
return path[0] == L'\\' || path[0] == L'/' ||
(path[0] && path[1] == L':');

This comment has been minimized.

@larryhastings

larryhastings May 14, 2018
Contributor

Ouch! ;-)

@larryhastings larryhastings merged commit 77c02cd into python:3.4 May 14, 2018
4 checks passed
4 checks passed
bedevere/issue-number Issue number 33001 found
Details
bedevere/news News entry found in Misc/NEWS.d
continuous-integration/appveyor/pr AppVeyor build succeeded
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented May 14, 2018

@larryhastings: Please replace # with GH- in the commit message next time. Thanks!

@zooba zooba deleted the zooba:symlink-34 branch Sep 19, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

4 participants