bpo-31675: Fix memory leaks in Tkinter's methods splitlist() and split()

[serhiy-storchaka]

when pass a string larger than 2 GiB.

Decrease memory requirements for Tcl's bigmem tests.

https://bugs.python.org/issue31675

[vstinner]

I wrote a patch using "et#" PyArg format to prevent one strlen(), but I don't think that it's worth it. I expect that most proceeded strings are smaller than 100 characters, and strlen() is heavily optimized ;-)

diff --git a/Modules/_tkinter.c b/Modules/_tkinter.c
index 91d3dd583e..f8fee1a4ef 100644
--- a/Modules/_tkinter.c
+++ b/Modules/_tkinter.c
@@ -2220,7 +2220,8 @@ static PyObject *
 _tkinter_tkapp_splitlist(TkappObject *self, PyObject *arg)
 /*[clinic end generated code: output=13b51d34386d36fb input=2b2e13351e3c0b53]*/
 {
-    char *list;
+    char *list = NULL;
+    Py_ssize_t listlen;
     int argc;
     const char **argv;
     PyObject *v;
@@ -2254,10 +2255,18 @@ _tkinter_tkapp_splitlist(TkappObject *self, PyObject *arg)
         return PySequence_Tuple(arg);
     }
 
-    if (!PyArg_Parse(arg, "et:splitlist", "utf-8", &list))
+    if (!PyArg_Parse(arg, "et#:splitlist", "utf-8", &list, &listlen))
         return NULL;
 
-    CHECK_STRING_LENGTH(list);
+    if (listlen >= INT_MAX) {
+        PyErr_SetString(PyExc_OverflowError, "splitlist() string is too long");
+        return NULL;
+    }
+    if ((Py_ssize_t)strlen(list) != listlen) {
+        PyErr_SetString(PyExc_ValueError, "embedded null character");
+        return NULL;
+    }
+
     if (Tcl_SplitList(Tkapp_Interp(self), list,
                       &argc, &argv) == TCL_ERROR)  {
         PyMem_Free(list);

[vstinner]

LGTM.

[serhiy-storchaka]

Before creating this PR I wrote a patch which got rid of "et" and creating a temporary copy on the heap. But I think it should be only in 3.7. As a bug fix I choose simpler solution.

[miss-islington]

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 2.7, 3.6.
🐍🍒⛏🤖

[bedevere-bot]

GH-3874 is a backport of this pull request to the 3.6 branch.

[miss-islington]

Sorry, @serhiy-storchaka, I could not cleanly backport this to 2.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 27c623c845dd6e4b8e1782666ca3a956636da266 2.7

[bedevere-bot]

GH-3876 is a backport of this pull request to the 2.7 branch.