This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Crash in binascii_a2b_uu on corrupt data
Type: Stage:
Components: Library (Lib) Versions:
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: nnorwitz Nosy List: nnorwitz, scharf
Priority: normal Keywords: patch

Created on 2003-01-10 02:44 by scharf, last changed 2022-04-10 16:06 by admin. This issue is now closed.

Files
File name Uploaded Description Edit
binascii.c.patch scharf, 2003-01-10 02:48
Messages (3)
msg42394 - (view) Author: Michael Scharf (scharf) Date: 2003-01-10 02:44
When I unpacked 50 gigabytes of randomly downloaded 
usenet binary news posts python crashed (randomly) on 
windows. After long tracking (I did'nt have a debug 
version) I found the problem in binascii_a2b_uu:

When reading the input data, the boundaries of the input 
sting are not checked. With corrupted uuencoded data 
(the first bite gives the length of the encoded string), the 
function reads out of bounds of the input string. That is 
not a problem (in most cases) but sometimes (it 
happened typicallyafter 20-30 gibagytes of parsed data) 
the allocated string might be at the end of a 
memory 'segment' and there is no string after the 
allocated string. And that causes a crash.

I have attached a patch to solve the problem. (Python 
2.2.2)

Michael
msg42395 - (view) Author: Neal Norwitz (nnorwitz) * (Python committer) Date: 2003-01-16 21:42
Logged In: YES 
user_id=33168

I agree there is a problem, although I'm concerned about
changing the behaviour.  Currently, if the data is short it
is, it is filled with null characters.  With this patch an
exception is raised.  Ideally, the patch is correct, but my
concern is that many people rely on the output being
null-filled.

I believe the following change around line 207, keeps the
behaviour and would avoid the crash:

-               this_ch = *ascii_data;
+               this_ch = (ascii_len > 0) ? *ascii_data : 0;
msg42396 - (view) Author: Neal Norwitz (nnorwitz) * (Python committer) Date: 2004-06-16 02:21
Logged In: YES 
user_id=33168

I checked in the change in the previous comment.

 Modules/binascii.c 2.41

I believe that checkin solves this problem, so closing.
History
Date User Action Args
2022-04-10 16:06:07adminsetgithub: 37750
2003-01-10 02:44:19scharfcreate