Python ldb Py_ssize_t fixes

buildtools/wafsamba/samba_python.py

@@ -97,7 +97,18 @@ def SAMBA_PYTHON(bld, name,
     # when we support static python modules we'll need to gather
     # the list from all the SAMBA_PYTHON() targets
     if init_function_sentinel is not None:
-        cflags += '-DSTATIC_LIBPYTHON_MODULES=%s' % init_function_sentinel
+        cflags += ' -DSTATIC_LIBPYTHON_MODULES=%s' % init_function_sentinel
+
+    # From https://docs.python.org/2/c-api/arg.html:
+    # Starting with Python 2.5 the type of the length argument to
+    # PyArg_ParseTuple(), PyArg_ParseTupleAndKeywords() and PyArg_Parse()
+    # can be controlled by defining the macro PY_SSIZE_T_CLEAN before
+    # including Python.h. If the macro is defined, length is a Py_ssize_t
+    # rather than an int.
+
+    # Because <Python.h> if often included before includes.h/config.h
+    # This must be in the -D compiler options
+    cflags += ' -DPY_SSIZE_T_CLEAN=1'
 
     source = bld.EXPAND_VARIABLES(source, vars=vars)
 

lib/ldb/common/ldb_dn.c

@@ -586,6 +586,12 @@ static bool ldb_dn_explode(struct ldb_dn *dn)
 
 				p++;
 				*d++ = '\0';
+
+				/*
+				 * This talloc_memdup() is OK with the
+				 * +1 because *d has been set to '\0'
+				 * just above
+				 */
 				dn->components[dn->comp_num].value.data = \
 					(uint8_t *)talloc_memdup(dn->components, dt, l + 1);
 				dn->components[dn->comp_num].value.length = l;
@@ -708,6 +714,11 @@ static bool ldb_dn_explode(struct ldb_dn *dn)
 	}
 
 	*d++ = '\0';
+	/*
+	 * This talloc_memdup() is OK with the
+	 * +1 because *d has been set to '\0'
+	 * just above.
+	 */
 	dn->components[dn->comp_num].value.length = l;
 	dn->components[dn->comp_num].value.data =
 		(uint8_t *)talloc_memdup(dn->components, dt, l + 1);
@@ -1901,17 +1912,37 @@ int ldb_dn_set_component(struct ldb_dn *dn, int num,
 		return LDB_ERR_OTHER;
 	}
 
+	if (num < 0) {
+		return LDB_ERR_OTHER;
+	}
+
+	if (v.length > v.length + 1) {
+		return LDB_ERR_OTHER;
+	}
+
 	n = talloc_strdup(dn, name);
 	if ( ! n) {
 		return LDB_ERR_OTHER;
 	}
 
 	v.length = val.length;
-	v.data = (uint8_t *)talloc_memdup(dn, val.data, v.length+1);
+
+	/*
+	 * This is like talloc_memdup(dn, v.data, v.length + 1), but
+	 * avoids the over-read
+	 */
+	v.data = (uint8_t *)talloc_size(dn, v.length+1);
 	if ( ! v.data) {
 		talloc_free(n);
 		return LDB_ERR_OTHER;
 	}
+	memcpy(v.data, val.data, val.length);
+
+	/*
+	 * Enforce NUL termination outside the stated length, as is
+	 * traditional in LDB
+	 */
+	v.data[v.length] = '\0';
 
 	talloc_free(dn->components[num].name);
 	talloc_free(dn->components[num].value.data);

lib/ldb/pyldb.c

@@ -489,7 +489,7 @@ static PyObject *py_ldb_dn_set_extended_component(PyLdbDnObject *self, PyObject
 	char *name;
 	int err;
 	uint8_t *value;
-	int size = 0;
+	Py_ssize_t size = 0;
 
 	if (!PyArg_ParseTuple(args, "sz#", &name, (const char**)&value, &size))
 		return NULL;
@@ -3642,7 +3642,7 @@ static PyObject *py_valid_attr_name(PyObject *self, PyObject *args)
 static PyObject *py_binary_encode(PyObject *self, PyObject *args)
 {
 	char *str, *encoded;
-	int size = 0;
+	Py_ssize_t size = 0;
 	struct ldb_val val;
 	PyObject *ret;
 

pidl/lib/Parse/Pidl/Samba4/Python.pm

@@ -282,7 +282,7 @@ sub PythonStruct($$$$$$)
 		$self->indent;
 		$self->pidl("$cname *object = ($cname *)pytalloc_get_ptr(py_obj);");
 		$self->pidl("DATA_BLOB blob;");
-		$self->pidl("int blob_length = 0;");
+		$self->pidl("Py_ssize_t blob_length = 0;");
 		$self->pidl("enum ndr_err_code err;");
 		$self->pidl("const char * const kwnames[] = { \"data_blob\", \"allow_remaining\", NULL };");
 		$self->pidl("PyObject *allow_remaining_obj = NULL;");
@@ -1490,6 +1490,7 @@ sub Parse($$$$$)
 
     $self->pidl_hdr("
 /* Python wrapper functions auto-generated by pidl */
+#define PY_SSIZE_T_CLEAN 1 /* We use Py_ssize_t for PyArg_ParseTupleAndKeywords */
 #include <Python.h>
 #include \"includes.h\"
 #include <pytalloc.h>

source3/libsmb/pylibsmb.c

@@ -650,7 +650,7 @@ static PyObject *py_cli_write(struct py_cli_state *self, PyObject *args,
 	int fnum;
 	unsigned mode = 0;
 	char *buf;
-	int buflen;
+	Py_ssize_t buflen;
 	unsigned long long offset;
 	struct tevent_req *req;
 	NTSTATUS status;

source3/passdb/py_passdb.c

@@ -27,13 +27,6 @@
 #include "secrets.h"
 #include "idmap.h"
 
-/* There's no Py_ssize_t in 2.4, apparently */
-#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5
-typedef int Py_ssize_t;
-typedef inquiry lenfunc;
-typedef intargfunc ssizeargfunc;
-#endif
-
 #ifndef Py_TYPE /* Py_TYPE is only available on Python > 2.6 */
 #define Py_TYPE(ob)             (((PyObject*)(ob))->ob_type)
 #endif

source4/auth/pyauth.c

@@ -36,13 +36,6 @@ void initauth(void);
 
 staticforward PyTypeObject PyAuthContext;
 
-/* There's no Py_ssize_t in 2.4, apparently */
-#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5
-typedef int Py_ssize_t;
-typedef inquiry lenfunc;
-typedef intargfunc ssizeargfunc;
-#endif
-
 static PyObject *PyAuthSession_FromSession(struct auth_session_info *session)
 {
 	return py_return_ndr_struct("samba.dcerpc.auth", "session_info", session, session);

source4/dsdb/pydsdb.c

@@ -31,13 +31,6 @@
 
 void initdsdb(void);
 
-/* There's no Py_ssize_t in 2.4, apparently */
-#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5
-typedef int Py_ssize_t;
-typedef inquiry lenfunc;
-typedef intargfunc ssizeargfunc;
-#endif
-
 /* FIXME: These should be in a header file somewhere */
 #define PyErr_LDB_OR_RAISE(py_ldb, ldb) \
 	if (!py_check_dcerpc_type(py_ldb, "ldb", "Ldb")) { \

source4/lib/messaging/pymessaging.c

@@ -147,7 +147,7 @@ static PyObject *py_imessaging_send(PyObject *self, PyObject *args, PyObject *kw
 	NTSTATUS status;
 	struct server_id server;
 	const char *kwnames[] = { "target", "msg_type", "data", NULL };
-	int length;
+	Py_ssize_t length;
 
 	if (!PyArg_ParseTupleAndKeywords(args, kwargs, "Ois#:send", 
 		discard_const_p(char *, kwnames), &target, &msg_type, &data.data, &length)) {

source4/lib/registry/pyregistry.c

@@ -212,7 +212,7 @@ static PyObject *py_hive_key_set_value(PyObject *self, PyObject *args)
 	char *name;
 	uint32_t type;
 	DATA_BLOB value;
-	int value_length = 0;
+	Py_ssize_t value_length = 0;
 	WERROR result;
 	struct hive_key *key = PyHiveKey_AsHiveKey(self);
 

source4/librpc/rpc/pyrpc.c

@@ -200,7 +200,7 @@ static PyObject *py_iface_request(PyObject *self, PyObject *args, PyObject *kwar
 	DATA_BLOB data_in, data_out;
 	NTSTATUS status;
 	char *in_data;
-	int in_length;
+	Py_ssize_t in_length;
 	PyObject *ret;
 	PyObject *object = NULL;
 	struct GUID object_guid;

source4/ntvfs/posix/python/pyposix_eadb.c

@@ -39,7 +39,7 @@ static PyObject *py_wrap_setxattr(PyObject *self, PyObject *args)
 {
 	char *filename, *attribute, *tdbname;
 	DATA_BLOB blob;
-	int blobsize;
+	Py_ssize_t blobsize;
 	NTSTATUS status;
 	TALLOC_CTX *mem_ctx;
 	struct tdb_wrap *eadb;

source4/ntvfs/posix/python/pyxattr_native.c

@@ -38,7 +38,7 @@ static PyObject *py_wrap_setxattr(PyObject *self, PyObject *args)
 {
 	char *filename, *attribute;
 	int ret = 0;
-	int blobsize;
+	Py_ssize_t blobsize;
 	DATA_BLOB blob;
 
 	if (!PyArg_ParseTuple(args, "sss#", &filename, &attribute, &blob.data, 

source4/ntvfs/posix/python/pyxattr_tdb.c

@@ -43,7 +43,7 @@ static PyObject *py_wrap_setxattr(PyObject *self, PyObject *args)
 {
 	char *filename, *attribute, *tdbname;
 	DATA_BLOB blob;
-	int blobsize;
+	Py_ssize_t blobsize;
 	int ret;
 	TALLOC_CTX *mem_ctx;
 	struct loadparm_context *lp_ctx;

source4/param/pyparam.c

@@ -26,12 +26,6 @@
 
 void initparam(void);
 
-/* There's no Py_ssize_t in 2.4, apparently */
-#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5
-typedef int Py_ssize_t;
-typedef inquiry lenfunc;
-#endif
-
 #define PyLoadparmContext_AsLoadparmContext(obj) pytalloc_get_type(obj, struct loadparm_context)
 #define PyLoadparmService_AsLoadparmService(obj) pytalloc_get_type(obj, struct loadparm_service)
 

source4/web_server/wsgi.c

@@ -28,13 +28,6 @@
 #include "lib/tsocket/tsocket.h"
 #include "python/modules.h"
 
-/* There's no Py_ssize_t in 2.4, apparently */
-#if PY_MAJOR_VERSION == 2 && PY_MINOR_VERSION < 5
-typedef int Py_ssize_t;
-typedef inquiry lenfunc;
-typedef intargfunc ssizeargfunc;
-#endif
-
 typedef struct {
 	PyObject_HEAD
 	struct websrv_context *web;