Sébastien Sablé <sa...@users.sourceforge.net> added the comment:

The problem is in CTextIOWrapperTest.test_issue1395_5
Here is the backtrace:

        msvcr100d.dll!memset()  Line 145        Asm
>       msvcr100d.dll!_heap_alloc_dbg_impl(unsigned __int64 nSize, int 
> nBlockUse, const char * szFileName, int nLine, int * errno_tmp)  Line 498     
>    C++
        msvcr100d.dll!_nh_malloc_dbg_impl(unsigned __int64 nSize, int nhFlag, 
int nBlockUse, const char * szFileName, int nLine, int * errno_tmp)  Line 239 + 
0x22 bytes        C++
        msvcr100d.dll!_nh_malloc_dbg(unsigned __int64 nSize, int nhFlag, int 
nBlockUse, const char * szFileName, int nLine)  Line 302 + 0x2a bytes      C++
        msvcr100d.dll!malloc(unsigned __int64 nSize)  Line 56 + 0x21 bytes      
C++
        python27_d.dll!PyObject_Malloc(unsigned __int64 nbytes)  Line 944       
C
        python27_d.dll!_PyObject_DebugMallocApi(char id, unsigned __int64 
nbytes)  Line 1445 + 0xa bytes        C
        python27_d.dll!_PyObject_DebugMalloc(unsigned __int64 nbytes)  Line 
1413        C
        python27_d.dll!PyString_FromStringAndSize(const char * str, __int64 
size)  Line 88 + 0x11 bytes C
        python27_d.dll!do_mkvalue(const char * * p_format, char * * p_va, int 
flags)  Line 427 + 0xf bytes      C
        python27_d.dll!va_build_value(const char * format, char * va, int 
flags)  Line 537 + 0x14 bytes C
        python27_d.dll!_Py_VaBuildValue_SizeT(const char * format, char * va)  
Line 511 C
        python27_d.dll!_PyObject_CallMethod_SizeT(_object * o, char * name, 
char * format, ...)  Line 2671 + 0xf bytes  C
        python27_d.dll!textiowrapper_tell(textio * self, _object * args)  Line 
2222 + 0x2c bytes        C



So the problem happens when calling in textio.c:
{{{
PyObject *decoded = PyObject_CallMethod(
            self->decoder, "decode", "s#", input, 1);
}}}

self->decoder is of type "_io.IncrementalNewlineDecoder" and input is "BBB".

This will result in PyString_FromStringAndSize being called with size = 
4294967297, which will cause the server to fall.

----------

_______________________________________
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue13461>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

Reply via email to