Skip to content

Commit a6fbd4b

Browse files
gh-143637: Fix reentrant mutation crash in socket.sendmsg
1 parent 7e57097 commit a6fbd4b

2 files changed

Lines changed: 10 additions & 18 deletions

File tree

Lib/test/test_socket.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3596,7 +3596,7 @@ def __index__(self):
35963596
left, right = socket.socketpair()
35973597
self.addCleanup(left.close)
35983598
self.addCleanup(right.close)
3599-
3599+
36003600
with self.assertRaises(Exception):
36013601
left.sendmsg([b'x'], seq)
36023602

Modules/socketmodule.c

Lines changed: 9 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5007,30 +5007,22 @@ _socket_socket_sendmsg_impl(PySocketSockObject *s, PyObject *data_arg,
50075007
Py_INCREF(item);
50085008

50095009
if (!PyArg_Parse(item,
5010-
"(iiy*):[sendmsg() ancillary data items]",
5011-
&cmsgs[ncmsgbufs].level,
5012-
&cmsgs[ncmsgbufs].type,
5013-
&cmsgs[ncmsgbufs].data))
5010+
"(iiy*):[sendmsg() ancillary data items]",
5011+
&cmsgs[ncmsgbufs].level,
5012+
&cmsgs[ncmsgbufs].type,
5013+
&cmsgs[ncmsgbufs].data)){
50145014
Py_DECREF(item);
50155015
goto finally;
5016+
}
50165017
Py_DECREF(item);
5018+
50175019
bufsize = cmsgs[ncmsgbufs++].data.len;
5018-
space=CMSG_SPACE(bufsize);
5019-
if(space>maxcmsgslen){
5020-
PyErr_SetString(PyExc_OSError, "ancillary data item too large");
5021-
goto finally;
5022-
}
5023-
maxcmsgslen+=space;
5024-
}
5025-
#ifdef CMSG_SPACE
5026-
if (!get_CMSG_SPACE(bufsize, &space)) {
5027-
#else
5028-
if (!get_CMSG_LEN(bufsize, &space)) {
5029-
#endif
5020+
5021+
if(!get_CMSG_SPACE(bufsize, &space)){
50305022
PyErr_SetString(PyExc_OSError, "ancillary data item too large");
50315023
goto finally;
50325024
}
5033-
controllen += space;
5025+
controllen+=space;
50345026
if (controllen > SOCKLEN_T_LIMIT || controllen < controllen_last) {
50355027
PyErr_SetString(PyExc_OSError, "too much ancillary data");
50365028
goto finally;

0 commit comments

Comments
 (0)