Skip to content

Commit 8e20fed

Browse files
gh-101178: Fix possible integer overflow in Ascii85 encoder with wrapcol=1
It could happen if the size of the input is more than 4/5 of sys.maxsize (only feasible on 32-bit platforms). Also simplify the integer overflow checks in the Base64 encoder, and harmonize them with the code for Ascii85 and Base85.
1 parent eb6ebdb commit 8e20fed

File tree

1 file changed

+8
-17
lines changed

1 file changed

+8
-17
lines changed

Modules/binascii.c

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -785,22 +785,21 @@ binascii_b2a_base64_impl(PyObject *module, Py_buffer *data, size_t wrapcol,
785785
* Use unsigned integer arithmetic to avoid signed integer overflow.
786786
*/
787787
size_t out_len = ((size_t)bin_len + 2u) / 3u * 4u;
788-
if (out_len > PY_SSIZE_T_MAX) {
789-
goto toolong;
790-
}
791788
if (wrapcol && out_len) {
792789
/* Each line should encode a whole number of bytes. */
793790
wrapcol = wrapcol < 4 ? 4 : wrapcol / 4 * 4;
794791
out_len += (out_len - 1u) / wrapcol;
795-
if (out_len > PY_SSIZE_T_MAX) {
796-
goto toolong;
797-
}
798792
}
799793
if (newline) {
800794
out_len++;
801-
if (out_len > PY_SSIZE_T_MAX) {
802-
goto toolong;
795+
}
796+
if (out_len > PY_SSIZE_T_MAX) {
797+
binascii_state *state = get_binascii_state(module);
798+
if (state == NULL) {
799+
return NULL;
803800
}
801+
PyErr_SetString(state->Error, "Too much data for base64");
802+
return NULL;
804803
}
805804
PyBytesWriter *writer = PyBytesWriter_Create(out_len);
806805
if (writer == NULL) {
@@ -841,14 +840,6 @@ binascii_b2a_base64_impl(PyObject *module, Py_buffer *data, size_t wrapcol,
841840
*ascii_data++ = '\n'; /* Append a courtesy newline */
842841

843842
return PyBytesWriter_FinishWithPointer(writer, ascii_data);
844-
845-
toolong:;
846-
binascii_state *state = get_binascii_state(module);
847-
if (state == NULL) {
848-
return NULL;
849-
}
850-
PyErr_SetString(state->Error, "Too much data for base64");
851-
return NULL;
852843
}
853844

854845
/*[clinic input]
@@ -1046,7 +1037,7 @@ binascii_b2a_ascii85_impl(PyObject *module, Py_buffer *data, int foldspaces,
10461037
if (!pad && (bin_len % 4)) {
10471038
out_len -= 4 - (bin_len % 4);
10481039
}
1049-
if (wrapcol && out_len) {
1040+
if (wrapcol && out_len && out_len <= PY_SSIZE_T_MAX) {
10501041
out_len += (out_len - 1) / wrapcol;
10511042
}
10521043
if (out_len > PY_SSIZE_T_MAX) {

0 commit comments

Comments
 (0)