Commit c701ef8
committed
Convert Packer's buf_size once
buf_size was untyped, so Cython converted it to size_t separately for
the PyMem_Malloc call and for pk.buf_size. An object whose __int__
answers differently each call made the packer allocate one size and
record another, and pack.h then grew the buffer against the recorded
capacity, so a large enough payload was memcpy'd past the allocation.
Typing the parameter converts it once during argument unpacking, the
same way Unpacker takes read_size and max_buffer_size.
Fixes #7231 parent 809bfcd commit c701ef8
2 files changed
Lines changed: 22 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
110 | 110 | | |
111 | 111 | | |
112 | 112 | | |
113 | | - | |
| 113 | + | |
114 | 114 | | |
115 | 115 | | |
116 | 116 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
179 | 179 | | |
180 | 180 | | |
181 | 181 | | |
| 182 | + | |
| 183 | + | |
| 184 | + | |
| 185 | + | |
| 186 | + | |
| 187 | + | |
| 188 | + | |
| 189 | + | |
| 190 | + | |
| 191 | + | |
| 192 | + | |
| 193 | + | |
| 194 | + | |
| 195 | + | |
| 196 | + | |
| 197 | + | |
| 198 | + | |
| 199 | + | |
| 200 | + | |
| 201 | + | |
| 202 | + | |
0 commit comments