diff options
| -rw-r--r-- | py/objdeque.c | 8 | ||||
| -rw-r--r-- | tests/basics/deque1.py | 6 |
2 files changed, 13 insertions, 1 deletions
diff --git a/py/objdeque.c b/py/objdeque.c index a4c42c31f..573a48baf 100644 --- a/py/objdeque.c +++ b/py/objdeque.c @@ -50,9 +50,15 @@ STATIC mp_obj_t deque_make_new(const mp_obj_type_t *type, size_t n_args, size_t mp_raise_ValueError(NULL); } + // Protect against -1 leading to zero-length allocation and bad array access + mp_int_t maxlen = mp_obj_get_int(args[1]); + if (maxlen < 0) { + mp_raise_ValueError(NULL); + } + mp_obj_deque_t *o = m_new_obj(mp_obj_deque_t); o->base.type = type; - o->alloc = mp_obj_get_int(args[1]) + 1; + o->alloc = maxlen + 1; o->i_get = o->i_put = 0; o->items = m_new(mp_obj_t, o->alloc); mp_seq_clear(o->items, 0, o->alloc, sizeof(*o->items)); diff --git a/tests/basics/deque1.py b/tests/basics/deque1.py index 6b5669c45..19966fcb0 100644 --- a/tests/basics/deque1.py +++ b/tests/basics/deque1.py @@ -55,6 +55,12 @@ d.append(4) d.append(5) print(d.popleft(), d.popleft()) +# Negative maxlen is not allowed +try: + deque((), -1) +except ValueError: + print("ValueError") + # Unsupported unary op try: ~d |