diff --git a/Modules/zipimport.c b/Modules/zipimport.c --- a/Modules/zipimport.c +++ b/Modules/zipimport.c @@ -861,6 +861,10 @@ get_data(char *archive, PyObject *toc_en &date, &crc)) { return NULL; } + if (data_size < 0) { + PyErr_Format(ZipImportError, "negative data size"); + return NULL; + } fp = fopen(archive, "rb"); if (!fp) { @@ -895,6 +895,11 @@ get_data(char *archive, PyObject *toc_en PyMarshal_ReadShortFromFile(fp); /* local header size */ file_offset += l; /* Start of file data */ + if (data_size > LONG_MAX - 1) { + fclose(fp); + PyErr_NoMemory(); + return NULL; + } raw_data = PyString_FromStringAndSize((char *)NULL, compress == 0 ? data_size : data_size + 1); if (raw_data == NULL) {