Re: [Libguestfs] [hivex] python: Check type of variable passed into set_value.

The following code, reported by Peter Wu <peter(a)lekensteyn.nl&gt;, broke on x86_64 with different symptoms on Python2 and Python3 (malloc() failure and segmentation fault, respectively): r = h.node_set_value(h.root(), { 'key': 'broken', 't': 4, 'value': 1234 }) --- generator/generator.ml | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/generator/generator.ml b/generator/generator.ml index bcf1966..0fa5c04 100755 --- a/generator/generator.ml +++ b/generator/generator.ml @@ -2799,6 +2799,7 @@ typedef int Py_ssize_t; #include <stdio.h> #include <stdlib.h> #include <assert.h> +#include <inttypes.h> #include \"hivex.h\" @@ -2868,14 +2869,28 @@ get_value (PyObject *v, hive_set_value *ret) PyErr_SetString (PyExc_RuntimeError, \"no 'value' element in dictionary\"); return -1; } + if (PyInt_Check (obj)) {

+ uint32_t* v = malloc (sizeof (uint32_t)); + *v = PyInt_AsLong (obj);

+ ret->value = (char*) v; + ret->len = sizeof (uint32_t); #ifdef HAVE_PYSTRING_ASSTRING - ret->value = PyString_AsString (obj); - ret->len = PyString_Size (obj); + } else if (PyString_Check (obj)) { + ret->value = PyString_AsString (obj); + ret->len = PyString_Size (obj); #else - bytes = PyUnicode_AsUTF8String (obj); - ret->value = PyBytes_AS_STRING (bytes); - ret->len = PyBytes_GET_SIZE (bytes); + } else if (PyUnicode_Check (obj)) { + bytes = PyUnicode_AsUTF8String (obj); + if (!bytes) { + return -1; + } + ret->value = PyBytes_AS_STRING (bytes); + ret->len = PyBytes_GET_SIZE (bytes); #endif + } else { + PyErr_SetString (PyExc_RuntimeError, \"Cannot use 'value' element in dictionary\"); + return -1; + } return 0; }