diff options
author | Campbell Barton <ideasman42@gmail.com> | 2021-07-29 07:09:30 +0300 |
---|---|---|
committer | Campbell Barton <ideasman42@gmail.com> | 2021-07-29 07:11:37 +0300 |
commit | 3c5068707344c15c876e726f90254e22ec4e1903 (patch) | |
tree | fd1d7479dc26457ffafddb535f33087f6bd1305a /source/blender | |
parent | fd0b2b8dfd60d689ffe562c99a25f2e879a1ca37 (diff) |
Fix gpu.types.GPUTexture crash when the size argument was too big
Missing length check on the size argument before copying it
into a fixed size buffer.
Diffstat (limited to 'source/blender')
-rw-r--r-- | source/blender/python/gpu/gpu_py_texture.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/source/blender/python/gpu/gpu_py_texture.c b/source/blender/python/gpu/gpu_py_texture.c index 4cbbd77438c..5d136921300 100644 --- a/source/blender/python/gpu/gpu_py_texture.c +++ b/source/blender/python/gpu/gpu_py_texture.c @@ -153,6 +153,12 @@ static PyObject *pygpu_texture__tp_new(PyTypeObject *UNUSED(self), PyObject *arg int len = 1; if (PySequence_Check(py_size)) { len = PySequence_Size(py_size); + if ((len < 1) || (len > 3)) { + PyErr_Format(PyExc_ValueError, + "GPUTexture.__new__: \"size\" must be between 1 and 3 in length (got %d)", + len); + return NULL; + } if (PyC_AsArray(size, sizeof(*size), py_size, len, &PyLong_Type, "GPUTexture.__new__") == -1) { return NULL; } |