Skip to content

Commit df256bc

Browse files
authored
fix: do not dup invalid file descriptor in compile method (#269)
When providing a file to the compile function, the PyObject_AsFileDescriptor function is used, which is safe to use on any object type: if the object is not a file, -1 is returned. However, this value was passed straight to a call to dup() without checking for its validity. This isn't much of an issue on unix where the dup call will simply fail as well and return -1, but it is very much an issue on windows where passing an invalid fd to dup will invoke the invalid parameter handler, which isn't set, so it will simply terminate the program. In other words, passing anything but a file to the file parameter of the compile function will make the program crash on Windows.
1 parent 03c802e commit df256bc

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

yara-python.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -2816,12 +2816,12 @@ static PyObject* yara_compile(
28162816
}
28172817
else if (file != NULL)
28182818
{
2819-
fd = dup(PyObject_AsFileDescriptor(file));
2819+
fd = PyObject_AsFileDescriptor(file);
28202820

28212821
if (fd != -1)
28222822
{
28232823
Py_BEGIN_ALLOW_THREADS
2824-
fh = fdopen(fd, "r");
2824+
fh = fdopen(dup(fd), "r");
28252825
error = yr_compiler_add_file(compiler, fh, NULL, NULL);
28262826
fclose(fh);
28272827
Py_END_ALLOW_THREADS

0 commit comments

Comments
 (0)