Skip to content

Conversation

zooba
Copy link
Member

@zooba zooba commented Mar 5, 2018

@zooba zooba added type-bug An unexpected behavior, bug, or error type-security A security issue OS-windows labels Mar 5, 2018
@bedevere-bot bedevere-bot added type-bug An unexpected behavior, bug, or error type-security A security issue labels Mar 5, 2018
@zooba
Copy link
Member Author

zooba commented Mar 5, 2018

@larryhastings FYI, but I'm still testing this one (don't keep VS 2010 handy these days, so it'll be a few hours). Don't rush to merge it

@zooba
Copy link
Member Author

zooba commented Mar 5, 2018

So I'm skipping the test on 3.4, because the (older) CRT will abort the process on a buffer overrun with the newer methods. I've confirmed that it's definitely a safe abort, but we don't have any way to do this within the process or test suite, so skipping the test but leaving it in there as a reference seems like the best option.

@zooba zooba changed the title [3.4] bpo-33001: Minimal fix to prevent buffer overrun in os.symlink (GH-5989) [3.4] bpo-33001: Prevent buffer overrun in os.symlink (GH-5989) Mar 5, 2018
@bedevere-bot bedevere-bot added type-bug An unexpected behavior, bug, or error type-security A security issue labels Mar 5, 2018
}

/* Is this path absolute? */
static int
_is_absW(const WCHAR *path)
{
return path[0] == L'\\' || path[0] == L'/' || path[1] == L':';
return path[0] == L'\\' || path[0] == L'/' ||
(path[0] && path[1] == L':');
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ouch! ;-)

@larryhastings larryhastings merged commit 77c02cd into python:3.4 May 14, 2018
@bedevere-bot
Copy link

@larryhastings: Please replace # with GH- in the commit message next time. Thanks!

@zooba zooba deleted the symlink-34 branch September 19, 2018 21:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
OS-windows type-bug An unexpected behavior, bug, or error type-security A security issue
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants