Update of /cvsroot/pywin32/pywin32/win32/src
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv32483/src
Modified Files:
win32file.i
Log Message:
As noticed by Roger, AcceptEx and WSARecv used the buffer interface
incorrectly, so allowed you to pass strings as a buffer that would be
modified!
Index: win32file.i
===================================================================
RCS file: /cvsroot/pywin32/pywin32/win32/src/win32file.i,v
retrieving revision 1.90
retrieving revision 1.91
diff -C2 -d -r1.90 -r1.91
*** win32file.i 4 May 2008 10:44:14 -0000 1.90
--- win32file.i 28 May 2008 04:32:21 -0000 1.91
***************
*** 1682,1691 ****
}
! if (obBuf->ob_type->tp_as_buffer)
{
pORB = obBuf;
Py_INCREF(pORB);
pb = pORB->ob_type->tp_as_buffer;
! dwBufSize = (*pb->bf_getreadbuffer)(pORB, 0, &buf);
if (dwBufSize < (DWORD)iMinBufferSize )
{
--- 1682,1693 ----
}
! if (obBuf->ob_type->tp_as_buffer && obBuf->ob_type->tp_as_buffer->bf_getwritebuffer)
{
pORB = obBuf;
Py_INCREF(pORB);
pb = pORB->ob_type->tp_as_buffer;
! dwBufSize = (*pb->bf_getwritebuffer)(pORB, 0, &buf);
! if (dwBufSize==(DWORD)-1 && PyErr_Occurred())
! goto Error;
if (dwBufSize < (DWORD)iMinBufferSize )
{
***************
*** 1839,1843 ****
iMinBufferSize = (wsProtInfo.iMaxSockAddr + 16) * 2;
! if (obBuf->ob_type->tp_as_buffer)
{
pORB = obBuf;
--- 1841,1845 ----
iMinBufferSize = (wsProtInfo.iMaxSockAddr + 16) * 2;
! if (obBuf->ob_type->tp_as_buffer && obBuf->ob_type->tp_as_buffer->bf_getreadbuffer)
{
pORB = obBuf;
***************
*** 1845,1848 ****
--- 1847,1852 ----
pb = pORB->ob_type->tp_as_buffer;
dwBufSize = (*pb->bf_getreadbuffer)(pORB, 0, &buf);
+ if (dwBufSize==(DWORD)-1 && PyErr_Occurred())
+ goto Error;
if (dwBufSize < (DWORD)iMinBufferSize )
{
***************
*** 2036,2044 ****
wsBuf.len = PyString_GET_SIZE(obBuf);
}
! else if (obBuf->ob_type->tp_as_buffer)
{
Py_INCREF(obBuf);
pb = obBuf->ob_type->tp_as_buffer;
wsBuf.len = (*pb->bf_getreadbuffer)(obBuf, 0, (void **)&wsBuf.buf);
}
else
--- 2040,2050 ----
wsBuf.len = PyString_GET_SIZE(obBuf);
}
! else if (obBuf->ob_type->tp_as_buffer && obBuf->ob_type->tp_as_buffer->bf_getreadbuffer)
{
Py_INCREF(obBuf);
pb = obBuf->ob_type->tp_as_buffer;
wsBuf.len = (*pb->bf_getreadbuffer)(obBuf, 0, (void **)&wsBuf.buf);
+ if (wsBuf.len==(u_long)-1 && PyErr_Occurred())
+ return NULL;
}
else
***************
*** 2141,2149 ****
}
! if (obBuf->ob_type->tp_as_buffer)
{
Py_INCREF(obBuf);
pb = obBuf->ob_type->tp_as_buffer;
! wsBuf.len = (*pb->bf_getreadbuffer)(obBuf, 0, (void **)&wsBuf.buf);
}
else
--- 2147,2157 ----
}
! if (obBuf->ob_type->tp_as_buffer && obBuf->ob_type->tp_as_buffer->bf_getwritebuffer)
{
Py_INCREF(obBuf);
pb = obBuf->ob_type->tp_as_buffer;
! wsBuf.len = (*pb->bf_getwritebuffer)(obBuf, 0, (void **)&wsBuf.buf);
! if (wsBuf.len==(u_long)-1 && PyErr_Occurred())
! return NULL;
}
else
|