Skip to content

gh-148286: Fix UB in ZstdDecompressor.unused_data when a frame is decompressed in one call #153258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
StanFromIreland wants to merge 1 commit into
base: main
Choose a base branch
from
+11 −6
Open

gh-148286: Fix UB in ZstdDecompressor.unused_data when a frame is decompressed in one call #153258

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions Misc/NEWS.d/next/Library/2026-07-07-13-31-52.gh-issue-148286.-qu-em.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Fix undefined behavior in
:attr:`compression.zstd.ZstdDecompressor.unused_data` when a complete frame
was decompressed in a single call.
11 changes: 8 additions & 3 deletions Modules/_zstd/decompressor.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -594,9 +594,14 @@ _zstd_ZstdDecompressor_unused_data_get_impl(ZstdDecompressor *self)
}
else {
if (self->unused_data == NULL) {
self->unused_data = PyBytes_FromStringAndSize(
self->input_buffer + self->in_begin,
self->in_end - self->in_begin);
if (self->input_buffer == NULL) {
self->unused_data = Py_GetConstant(Py_CONSTANT_EMPTY_BYTES);
}
else {
self->unused_data = PyBytes_FromStringAndSize(
self->input_buffer + self->in_begin,
self->in_end - self->in_begin);
}
ret = self->unused_data;
Py_XINCREF(ret);
}
Expand Down
3 changes: 0 additions & 3 deletions Tools/ubsan/suppressions.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,5 @@ shift-base:Modules/_ctypes/cfield.c
# Modules/_ctypes/cfield.c:640:1: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
signed-integer-overflow:Modules/_ctypes/cfield.c

# Modules/_zstd/decompressor.c:598:56: runtime error: applying non-zero offset 18446744073709551615 to null pointer
pointer-overflow:Modules/_zstd/decompressor.c

# Modules/_io/stringio.c:350:24: runtime error: addition of unsigned offset to 0x7fd01ec25850 overflowed to 0x7fd01ec2584c
pointer-overflow:Modules/_io/stringio.c
Loading