Skip to content

[3.11] gh-95778: CVE-2020-10735: Prevent DoS by very large int() #96500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gpshead merged 11 commits into from
Sep 2, 2022
Merged

[3.11] gh-95778: CVE-2020-10735: Prevent DoS by very large int() #96500

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
80dba63
Backport to 3.11 from psrt/CVE-2020-10735@ee533c68.
gpshead Aug 19, 2022
b9f4e89
Add the whatsnew entry.
gpshead Aug 19, 2022
58a4f64
Update attribution in Misc/NEWS.d
gpshead Aug 25, 2022
9e1f13d
Move int_max_str_digits out of PyInterpreterState
tiran Sep 1, 2022
4647594
Revert "Move int_max_str_digits out of PyInterpreterState"
tiran Sep 1, 2022
53e12ec
Manually add new field to abi file
tiran Sep 1, 2022
90e020b
Make the doctest actually run & fix it.
gpshead Sep 1, 2022
d6d668a
Fix the docs build.
gpshead Sep 2, 2022
dfe1922
Merge branch '3.11' into CVE-2020-10735-3.11backport
gpshead Sep 2, 2022
282052f
Rename the news file to appease the Bedevere bot.
gpshead Sep 2, 2022
c4aea14
hexadecimal spelling =)
gpshead Sep 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Revert "Move int_max_str_digits out of PyInterpreterState" 
This reverts commit 9e1f13d.
  • Loading branch information
@tiran
tiran committed Sep 1, 2022
commit 4647594b21a523c654c87f9e88b2c23ddc730bf8
6 changes: 2 additions & 4 deletions Include/internal/pycore_interp.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,6 +176,8 @@ struct _is {
struct type_cache type_cache;
struct callable_cache callable_cache;

int int_max_str_digits;

/* The following fields are here to avoid allocation during init.
The data is exposed through PyInterpreterState pointer fields.
These fields should not be accessed directly outside of init.
Expand All @@ -192,10 +194,6 @@ struct _is {
PyThreadState _initial_thread;
};

/* The value should be part of PyInterpreterState. However that would change
* the size of the struct and therefore break our ABI promise. Abigail
* does not like it... Oh my! */
extern int _Py_int_max_str_digits;

/* other API */

Expand Down
14 changes: 7 additions & 7 deletions Objects/longobject.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1786,7 +1786,8 @@ long_to_decimal_string_internal(PyObject *aa,
strlen++;
}
if (strlen > _PY_LONG_MAX_STR_DIGITS_THRESHOLD) {
int max_str_digits = _Py_int_max_str_digits;
PyInterpreterState *interp = _PyInterpreterState_GET();
int max_str_digits = interp->int_max_str_digits;
Py_ssize_t strlen_nosign = strlen - negative;
if ((max_str_digits > 0) && (strlen_nosign > max_str_digits)) {
Py_DECREF(scratch);
Expand Down Expand Up @@ -2462,7 +2463,8 @@ digit beyond the first.

/* Limit the size to avoid excessive computation attacks. */
if (digits > _PY_LONG_MAX_STR_DIGITS_THRESHOLD) {
int max_str_digits = _Py_int_max_str_digits;
PyInterpreterState *interp = _PyInterpreterState_GET();
int max_str_digits = interp->int_max_str_digits;
if ((max_str_digits > 0) && (digits > max_str_digits)) {
PyErr_Format(PyExc_ValueError, _MAX_STR_DIGITS_ERROR_FMT,
max_str_digits, digits);
Expand Down Expand Up @@ -6127,8 +6129,6 @@ PyLong_GetInfo(void)

/* runtime lifecycle */

int _Py_int_max_str_digits;

PyStatus
_PyLong_InitTypes(PyInterpreterState *interp)
{
Expand All @@ -6146,9 +6146,9 @@ _PyLong_InitTypes(PyInterpreterState *interp)
return _PyStatus_ERR("can't init int info type");
}
}
_Py_int_max_str_digits = _Py_global_config_int_max_str_digits;
if (_Py_int_max_str_digits == -1) {
_Py_int_max_str_digits = _PY_LONG_DEFAULT_MAX_STR_DIGITS;
interp->int_max_str_digits = _Py_global_config_int_max_str_digits;
if (interp->int_max_str_digits == -1) {
interp->int_max_str_digits = _PY_LONG_DEFAULT_MAX_STR_DIGITS;
}

return _PyStatus_OK();
Expand Down
5 changes: 3 additions & 2 deletions Python/sysmodule.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1633,7 +1633,7 @@ sys_get_int_max_str_digits_impl(PyObject *module)
/*[clinic end generated code: output=0042f5e8ae0e8631 input=8dab13e2023e60d5]*/
{
PyInterpreterState *interp = _PyInterpreterState_GET();
return PyLong_FromSsize_t(_Py_int_max_str_digits);
return PyLong_FromSsize_t(interp->int_max_str_digits);
}

/*[clinic input]
Expand All @@ -1648,8 +1648,9 @@ static PyObject *
sys_set_int_max_str_digits_impl(PyObject *module, int maxdigits)
/*[clinic end generated code: output=734d4c2511f2a56d input=d7e3f325db6910c5]*/
{
PyThreadState *tstate = _PyThreadState_GET();
if ((!maxdigits) || (maxdigits >= _PY_LONG_MAX_STR_DIGITS_THRESHOLD)) {
_Py_int_max_str_digits = maxdigits;
tstate->interp->int_max_str_digits = maxdigits;
Py_RETURN_NONE;
} else {
PyErr_Format(
Expand Down