[issue43303] ASAN : Memory leak in compilation

2021-02-24 Thread Ramin Farajpour Cami


Change by Ramin Farajpour Cami :


--
stage:  -> resolved
status: open -> closed

___
Python tracker 
<https://bugs.python.org/issue43303>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue43303] ASAN : Memory leak in compilation

2021-02-22 Thread Ramin Farajpour Cami


Change by Ramin Farajpour Cami :


--
nosy: +christian.heimes, lys.nikolaou, pablogsal

___
Python tracker 
<https://bugs.python.org/issue43303>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue43303] ASAN : Memory leak in compilation

2021-02-22 Thread Ramin Farajpour Cami


New submission from Ramin Farajpour Cami :

Hi,


Asan has detected a memory leak :

$ wget https://github.com/python/cpython/archive/v3.9.2.tar.gz
$ tar xvf v3.9.2.tar.gz
$ ./configure --disable-shared CFLAGS="-fsanitize=address -ggdb" 
CXXFLAGS="-fsanitize=address -ggdb" LDFLAGS="-fsanitize=address"
$ make -j4
$ ~/cpython-3.9.2# ./python -E -S -m sysconfig --generate-posix-vars

=
==330505==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 300082 byte(s) in 137 object(s) allocated from:
#0 0x7f647a692bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x55a58e972015 in PyMem_RawMalloc Objects/obmalloc.c:572
#2 0x55a58e972015 in _PyObject_Malloc Objects/obmalloc.c:1645
#3 0x55a58e972015 in _PyObject_Malloc Objects/obmalloc.c:1638

Direct leak of 2066 byte(s) in 2 object(s) allocated from:
#0 0x7f647a692ffe in __interceptor_realloc 
(/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
#1 0x55a58e9c9e7d in resize_compact Objects/unicodeobject.c:1079

Direct leak of 672 byte(s) in 1 object(s) allocated from:
#0 0x7f647a692ffe in __interceptor_realloc 
(/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
#1 0x55a58eb6c620 in _PyObject_GC_Resize Modules/gcmodule.c:2297

Indirect leak of 110001 byte(s) in 115 object(s) allocated from:
#0 0x7f647a692bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x55a58e972015 in PyMem_RawMalloc Objects/obmalloc.c:572
#2 0x55a58e972015 in _PyObject_Malloc Objects/obmalloc.c:1645
#3 0x55a58e972015 in _PyObject_Malloc Objects/obmalloc.c:1638

Indirect leak of 536 byte(s) in 1 object(s) allocated from:
#0 0x7f647a692bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x55a58e972382 in _PyObject_Malloc Objects/obmalloc.c:572
#2 0x55a58e972382 in pymalloc_realloc Objects/obmalloc.c:1988
#3 0x55a58e972382 in _PyObject_Realloc Objects/obmalloc.c:2007

SUMMARY: AddressSanitizer: 413357 byte(s) leaked in 256 allocation(s).


Thanks,
Ramin

--
components: Build
messages: 387551
nosy: Ramin Farajpour Cami
priority: normal
severity: normal
status: open
title: ASAN : Memory leak in compilation
type: resource usage
versions: Python 3.10, Python 3.8, Python 3.9

___
Python tracker 
<https://bugs.python.org/issue43303>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue43260] Never release buffer when MemoryError in print()

2021-02-20 Thread Ramin Farajpour Cami


Change by Ramin Farajpour Cami :


--
nosy: +vstinner

___
Python tracker 
<https://bugs.python.org/issue43260>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue43260] Never release buffer when MemoryError in print()

2021-02-18 Thread Ramin Farajpour Cami


Change by Ramin Farajpour Cami :


--
type:  -> crash

___
Python tracker 
<https://bugs.python.org/issue43260>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue43260] Never release buffer when MemoryError in print()

2021-02-18 Thread Ramin Farajpour Cami


Ramin Farajpour Cami  added the comment:

Python 3.9.1 (tags/v3.9.1:1e5d33e, Dec  7 2020, 16:33:24) [MSC v.1928 32 bit 
(Intel)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> print("a"*10)
Traceback (most recent call last):
  File "", line 1, in 
MemoryError
>>> print("1")
Traceback (most recent call last):
  File "", line 1, in 
MemoryError
>>>

--

___
Python tracker 
<https://bugs.python.org/issue43260>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue43260] Never release buffer when MemoryError in print()

2021-02-18 Thread Ramin Farajpour Cami


Ramin Farajpour Cami  added the comment:

Version : 

Python 3.8.5 (tags/v3.8.5:580fbb0, Jul 20 2020, 15:43:08) [MSC v.1926 32 bit 
(Intel)] on win32

--

___
Python tracker 
<https://bugs.python.org/issue43260>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue43260] Never release buffer when MemoryError in print()

2021-02-18 Thread Ramin Farajpour Cami


Change by Ramin Farajpour Cami :


--
title: Never release buffer when MemoryError in prtin() -> Never release buffer 
when MemoryError in print()

___
Python tracker 
<https://bugs.python.org/issue43260>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue43260] Never release buffer when MemoryError in prtin()

2021-02-18 Thread Ramin Farajpour Cami


New submission from Ramin Farajpour Cami :

Hi,


When we use "a"*100 in print("a"*100) function, Show 
"MemoryError",Again i use print("1") again display  "MemoryError", I think 
memory not release for use again, 


>>> print("a"*10)
Traceback (most recent call last):
  File "", line 1, in 
MemoryError
>>> print("1")
Traceback (most recent call last):
  File "", line 1, in 
MemoryError

When i exit() python interpeter, and again print("1") it's work.

And I test in linux its' work:
>>> print("a"*10)
Traceback (most recent call last):
  File "", line 1, in 
MemoryError
>>> print("1")
1
>>> print("a")
a
>>>


Thanks.
Ramin

--
components: Windows
messages: 387282
nosy: Ramin Farajpour Cami, paul.moore, steve.dower, tim.golden, zach.ware
priority: normal
severity: normal
status: open
title: Never release buffer when MemoryError in prtin()
versions: Python 3.8

___
Python tracker 
<https://bugs.python.org/issue43260>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26337] Bypass imghdr module determines the type of image

2016-02-11 Thread Ramin Farajpour Cami

Changes by Ramin Farajpour Cami <ramin.black...@gmail.com>:


--
nosy: +serhiy.storchaka

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26337>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26337] Bypass imghdr module determines the type of image

2016-02-11 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

images can be served with a content type of text/html,(which means we can 
certainly inject HTML).

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26337>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26337] Bypass imghdr module determines the type of image

2016-02-11 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

In normal if you choose a image and open image with editor set codes to image 
you get error , but I able to bypass image for upload if I use module imghdr 
for check valid image , booom upload image with malicious code ,

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26337>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26337] Bypass imghdr module determines the type of image

2016-02-10 Thread Ramin Farajpour Cami

New submission from Ramin Farajpour Cami:

import imghdr
imghdr.what('phppng.png')

output : 
'png'

if you set javascript script in file .png or .jpg ,
output : 
ValueError: invalid \x escape

Hexdump:
root@Ramin:~# hexdump -C phppng.png
  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52
|.PNGIHDR|
0010  00 00 00 20 00 00 00 20  08 02 00 00 00 fc 18 ed  
|... ... |
0020  a3 00 00 00 09 70 48 59  73 00 00 0e c4 00 00 0e
|.pHYs...|
0030  c4 01 95 2b 0e 1b 00 00  00 60 49 44 41 54 48 89  |...+.`IDATH.|
0040  63 5c 3c 3f 3d 24 5f 47  45 54 5b 30 5d 28 24 5f  
|c\X|
0060  73 5e 37 93 fc 8f 8b db  7e 5f d3 7d aa 27 f7 f1  |s^7.~_.}.'..|
0070  e3 c9 bf 5f ef 06 7c b2  30 30 63 d9 b9 67 fd d9  |..._..|.00c..g..|
0080  3d 1b ce 32 8c 82 51 30  0a 46 c1 28 18 05 a3 60  |=..2..Q0.F.(...`|
0090  14 8c 82 51 30 0a 86 0d  00 00 81 b2 1b 02 07 78  |...Q0..x|
00a0  0d 0c 00 00 00 00 49 45  4e 44 ae 42 60 82|..IEND.B`.|
00ae

--
components: Library (Lib)
files: phppng.png
messages: 260074
nosy: Ramin Farajpour Cami
priority: normal
severity: normal
status: open
title: Bypass imghdr module determines the type of image
type: behavior
versions: Python 3.5
Added file: http://bugs.python.org/file41891/phppng.png

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26337>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-16 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

Yes!I use python version 2.7.11 and my Windows machine stop and crashed, on cmd 
Windows,

--
status: pending -> open

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-16 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

i test python version 2.7.11 32 bit i get your error , but 64 bit no crashed,


CommandLine: python.exe
Symbol search path is: 
srv*c:\pubsymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
ModLoad: 1c3c 1c3cb000   python.exe
ModLoad: 7702 77199000   ntdll.dll
ModLoad: 76d0 76df   C:\Windows\SysWOW64\KERNEL32.DLL
ModLoad: 76ea 77016000   C:\Windows\SysWOW64\KERNELBASE.dll
ModLoad: 5fd7 5fffe000   C:\Windows\SysWOW64\python27.dll
ModLoad: 71de 71e83000   
C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9158_none_5091b51ebcb97cdc\MSVCR90.dll
ModLoad: 7697 76ab   C:\Windows\SysWOW64\USER32.dll
ModLoad: 7614 7628d000   C:\Windows\SysWOW64\GDI32.dll
ModLoad: 76b1 76b8b000   C:\Windows\SysWOW64\ADVAPI32.dll
ModLoad: 76c4 76cfe000   C:\Windows\SysWOW64\msvcrt.dll
ModLoad: 75c2 75c63000   C:\Windows\SysWOW64\sechost.dll
ModLoad: 76df 76e9c000   C:\Windows\SysWOW64\RPCRT4.dll
ModLoad: 7413 7414e000   C:\Windows\SysWOW64\SspiCli.dll
ModLoad: 7412 7412a000   C:\Windows\SysWOW64\CRYPTBASE.dll
ModLoad: 740c 74119000   C:\Windows\SysWOW64\bcryptPrimitives.dll
ModLoad: 7415 7550e000   C:\Windows\SysWOW64\SHELL32.dll
ModLoad: 7551 759ec000   C:\Windows\SysWOW64\windows.storage.dll
ModLoad: 75c8 75e3a000   C:\Windows\SysWOW64\combase.dll
ModLoad: 76bf 76c34000   C:\Windows\SysWOW64\shlwapi.dll
ModLoad: 7629 7629c000   C:\Windows\SysWOW64\kernel.appcore.dll
ModLoad: 768e 7696d000   C:\Windows\SysWOW64\shcore.dll
ModLoad: 76ac 76b04000   C:\Windows\SysWOW64\powrprof.dll
ModLoad: 76ab 76abf000   C:\Windows\SysWOW64\profapi.dll
ModLoad: 768b 768db000   C:\Windows\SysWOW64\IMM32.DLL
ModLoad: 75fb 760d   C:\Windows\SysWOW64\MSCTF.dll
Python 2.7.11 (v2.7.11:6d1b6a68f775, Dec  5 2015, 20:32:19) [MSC v.1500 32 bit 
(Intel)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import strop
>>> strop.replace("\x100"*0xEAAA,"\x100","AA"*0x)
Traceback (most recent call last):
  File "", line 1, in 
MemoryError

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-16 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

here version :

C:\python2711>python.exe
Python 2.7.11 (v2.7.11:6d1b6a68f775, Dec  5 2015, 20:40:30) [MSC v.1500 64 bit 
(AMD64)] on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import strop
>>> strop.replace("\x100"*0xEAAA,"\x100","AA"*0x)

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-16 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

i try install windows on VMWare and get video for you, in primary OS i my 
system crash i can't save video or image for you ,

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-16 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

i trust me ,i don't undrestand :( , work for me this print 
strop.replace("\x100"*0xEAAA,"\x100","AA"*0x) .

now test again my system machine crash and i restart windows,


my info system :


Host Name: DESKTOP-84QSQQ8
OS Name:   Microsoft Windows 10 Enterprise
OS Version:10.0.10240 N/A Build 10240
OS Manufacturer:   Microsoft Corporation
OS Configuration:  Standalone Workstation
OS Build Type: Multiprocessor Free
Registered Owner:  RaminFP
Registered Organization:
Product ID:00329-0-3-AA066
Original Install Date: 11/6/2015, 6:12:53 AM
System Boot Time:  1/16/2016, 6:57:16 PM
System Manufacturer:   ASUSTeK Computer Inc.
System Model:  K52DY
System Type:   x64-based PC
Processor(s):  1 Processor(s) Installed.
   [01]: AMD64 Family 16 Model 5 Stepping 3 
AuthenticAMD ~1800 Mhz
BIOS Version:  American Megatrends Inc. K52DY.207, 1/27/2011
Windows Directory: C:\Windows
System Directory:  C:\Windows\system32
Boot Device:   \Device\HarddiskVolume2
System Locale: en-us;English (United States)
Input Locale:  en-us;English (United States)
Time Zone: (UTC+03:30) Tehran
Total Physical Memory: 4,094 MB
Available Physical Memory: 1,967 MB
Virtual Memory: Max Size:  6,270 MB
Virtual Memory: Available: 4,152 MB
Virtual Memory: In Use:2,118 MB
Page File Location(s): C:\pagefile.sys
Domain:WORKGROUP
Logon Server:  \\DESKTOP-84QSQQ8
Hotfix(s): 5 Hotfix(s) Installed.
   [01]: KB3087040
   [02]: KB3106932
   [03]: KB3116869
   [04]: KB3124266
   [05]: KB3133431
Network Card(s):   6 NIC(s) Installed.
   [01]: Qualcomm Atheros AR9002WB-1NG Wireless Network 
Adapter
 Connection Name: Wi-Fi
 DHCP Enabled:Yes
 DHCP Server: 192.168.1.1
 IP address(es)
 [01]: 192.168.1.101
 [02]: fe80::1d3d:b7fa:e576:7111
   [02]: JMicron PCI Express Gigabit Ethernet Adapter
 Connection Name: Ethernet
 Status:  Hardware not present
   [03]: Kerio Virtual Network Adapter
 Connection Name: Ethernet 5
 Status:  Media disconnected
   [04]: VMware Virtual Ethernet Adapter for VMnet1
 Connection Name: Ethernet 2
 Status:  Hardware not present
   [05]: Cisco AnyConnect Secure Mobility Client 
Virtual Miniport Adapter for Windows x64
 Connection Name: Ethernet 6
 Status:  Hardware not present
   [06]: VMware Virtual Ethernet Adapter for VMnet8
 Connection Name: Ethernet 3
 Status:  Hardware not present
Hyper-V Requirements:  VM Monitor Mode Extensions: Yes
   Virtualization Enabled In Firmware: Yes
   Second Level Address Translation: Yes
   Data Execution Prevention Available: Yes

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-16 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

also work it , windows 7 OS 64bit with python 2.7.11 64bit,

this is a vulnerability in python 2.7.11 64bit version,

please look video,

https://drive.google.com/file/d/0B0zktfkIvV-LajlIQ0p0eWZjd0U/view

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-16 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

Yes,

i have any idea,

Thanks,

--
resolution:  -> wont fix

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-16 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

"Your video only shows the operation taking a long time or hanging as far as I 
can tell," what your means?

i say my OS crash with run function strop i should restart manually for work 
again,

do you have idea for fix it ?

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-14 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

Not work ,i think should check sizeof of memory avoid overflow 
assert(new_len > 0 && new_len <= PY_SSIZE_T_MAX);

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-11 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

The issue can be triggered by performing a large substitution that overflows 
the arithmetic used in mymemreplace() to calculate the size of the new string:

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-11 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

please look image : 


Thanks,

--
Added file: http://bugs.python.org/file41580/123.PNG

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-11 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

Do you have any idea how to fix it?

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-11 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

static char *
mymemreplace(const char *str, Py_ssize_t len,   
 const char *pat, Py_ssize_t pat_len,pattern string to find 
*/
 const char *sub, Py_ssize_t sub_len,substitution string */
 Py_ssize_t count,   number of replacements 
*/
 Py_ssize_t *out_len)
{
[...]

new_len = len + nfound*(sub_len - pat_len); <<<< Unchecked arithmetic can 
overflow here.
if (new_len == 0) {
/* Have to allocate something for the caller to free(). */
out_s = (char *)PyMem_MALLOC(1);
if (out_s == NULL)
return NULL;
out_s[0] = '\0';
}
else {
assert(new_len > 0);
new_s = (char *)PyMem_MALLOC(new_len); <<<< An allocation is performed 
using overflowed value.
if (new_s == NULL)
return NULL;
out_s = new_s;

for (; count > 0 && len > 0; --count) { <<<< Memory is copied to new_s 
using len, which can be greater than the overflowed new_len value.
/* find index of next instance of pattern */
offset = mymemfind(str, len, pat, pat_len);
if (offset == -1)
break;

/* copy non matching part of input string */
memcpy(new_s, str, offset);
str += offset + pat_len;
len -= offset + pat_len;

/* copy substitute into the output string */
new_s += offset;
memcpy(new_s, sub, sub_len);
new_s += sub_len;
}
/* copy any remaining values into output string */
if (len > 0)
memcpy(new_s, str, len);
}

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-11 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

python 2.7.10 32bit and python 2.7.11 64bit crash on windows 10

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-11 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

also linux Ubuntu version Python 2.7.6

--
Added file: http://bugs.python.org/file41583/12.png

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue26059] Integer Overflow in strop.replace()

2016-01-11 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

I say work this problem on version 2.7.11

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue26059>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue25075] issue from python in encode base64 with Json Model

2015-09-11 Thread Ramin Farajpour Cami

New submission from Ramin Farajpour Cami:

Hi,

issue from python in encode base64 with Json Model in twice encode with base64 
output python different  with JAVA and C# , if programmer using rest-service in 
server side and other programmer using UI(Python Django) in client site , this 
encode different for encode and decode with match json encode model,


real example :

1- go to https://www.base64encode.org/ 
2- using {"userName":"admin","password":"admin"} (default UTF-8)
3-first encode oupput : "eyJ1c2VyTmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJhZG1pbiJ9"
4-again second encode "eyJ1c2VyTmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJhZG1pbiJ9" 
output :
"ZXlKMWMyVnlUbUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmlKOQ=="

now second output python json model : 

Microsoft Windows [Version 6.2.9200]
(c) 2012 Microsoft Corporation. All rights reserved.

C:\Users\Matthew F4rr3ll>python
Python 2.7.7 (default, Jun  1 2014, 14:21:57) [MSC v.1500 64 bit (AMD64)] on win
32
Type "help", "copyright", "credits" or "license" for more information.
>>> import json
>>> s1='{"userName":"admin","password":"admin"}'
>>> s2 = s1.encode("base64")
>>> e = s2.encode("base64")
>>> print e
ZXlKMWMyVnlUbUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmlKOQo=

>>>
>>>
>>>

now check this output : 
ZXlKMWMyVnlUbUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmlKOQo=
ZXlKMWMyVnlUbUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmlKOQ==

you see in two encode different in end line in ("o=" != "==")


also i know resolve this but you should fix in end line encode match with other 
language


Thanks,
Ramin

--
components: 2to3 (2.x to 3.x conversion tool)
messages: 250502
nosy: Ramin Farajpour Cami
priority: normal
severity: normal
status: open
title: issue from python in encode base64 with Json Model
type: behavior
versions: Python 2.7

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue25075>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue25075] issue from python in encode base64 with Json Model

2015-09-11 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

why any update in python 2.7?

you should using a function this code change :

enc_sec = 
ZXlKMWMyVnlUbUZ0WlNJNkltRmtiV2x1SWl3aWNHRnpjM2R2Y21RaU9pSmhaRzFwYmlKOQo=
url = re.sub('\o=$','',enc_sec)
result = url.replace('\n','==')
print result

--
status: closed -> open

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue25075>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com



[issue25075] issue from python in encode base64 with Json Model

2015-09-11 Thread Ramin Farajpour Cami

Ramin Farajpour Cami added the comment:

no close plz,

i using python 2.7.3 i get this output without "\n"?


code:
   json_obj='{"userName": "admin", "password": "admin"}'
   enc = json_obj.encode("base64")
   print enc
   enc_sec = re.sub('\n$','',enc)
   print enc_sec
   sec = enc_sec.encode("base64")
   print sec

Output:
{"userName": "admin", "password": "admin"}

eyJ1c2VyTmFtZSI6ICJhZG1pbiIsICJwYXNzd29yZCI6ICJhZG1pbiJ9

ZXlKMWMyVnlUbUZ0WlNJNklDSmhaRzFwYmlJc0lDSndZWE56ZDI5eVpDSTZJQ0poWkcxcGJpSjk=

--

___
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue25075>
___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com