gh-126594: Fix typeobject.c wrap_buffer() cast (#126754)

Reject flags smaller than INT_MIN.

Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
This commit is contained in:
Victor Stinner 2024-11-19 09:13:20 +01:00 committed by GitHub
parent b3687ad454
commit 84f07c3a4c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 18 additions and 3 deletions

View file

@ -9314,13 +9314,13 @@ wrap_buffer(PyObject *self, PyObject *args, void *wrapped)
if (flags == -1 && PyErr_Occurred()) {
return NULL;
}
if (flags > INT_MAX) {
if (flags > INT_MAX || flags < INT_MIN) {
PyErr_SetString(PyExc_OverflowError,
"buffer flags too large");
"buffer flags out of range");
return NULL;
}
return _PyMemoryView_FromBufferProc(self, Py_SAFE_DOWNCAST(flags, Py_ssize_t, int),
return _PyMemoryView_FromBufferProc(self, (int)flags,
(getbufferproc)wrapped);
}