Also ensure there are no overreads on the input data

This commit is contained in:
Kovid Goyal 2023-06-01 14:07:52 +05:30
parent eb80c90221
commit 7be68fceba
No known key found for this signature in database
GPG Key ID: 06BC317B515ACE7C

View File

@ -70,12 +70,12 @@ cpalmdoc_decompress(PyObject *self, PyObject *args) {
while (i < input_len) { while (i < input_len) {
c = input[i++]; c = input[i++];
if (c >= 1 && c <= 8) { // copy 'c' bytes if (c >= 1 && c <= 8) { // copy 'c' bytes
while (c--) { write(input[i++]); } while (c-- && i < input_len) { write(input[i++]); }
} else if (c <= 0x7F) { // 0, 09-7F = self } else if (c <= 0x7F) { // 0, 09-7F = self
write((char)c); write((char)c);
} else if (c >= 0xC0) { // space + ASCII char } else if (c >= 0xC0) { // space + ASCII char
write(' '); write(c ^ 0x80); write(' '); write(c ^ 0x80);
} else { // 80-BF repeat sequences } else if (i < input_len) { // 80-BF repeat sequences
c = (c << 8) + input[i++]; c = (c << 8) + input[i++];
di = (c & 0x3FFF) >> 3; di = (c & 0x3FFF) >> 3;
for ( n = (c & 7) + 3; n--; ++o ) { for ( n = (c & 7) + 3; n--; ++o ) {
@ -84,7 +84,7 @@ cpalmdoc_decompress(PyObject *self, PyObject *args) {
} }
} }
#undef write #undef write
if (input != NULL) PyMem_Free(input); PyMem_Free(input);
if (_PyBytes_Resize(&ans, o) != 0) return NULL; if (_PyBytes_Resize(&ans, o) != 0) return NULL;
return ans; return ans;
} }