Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
ca77774
Backport CVE-2020-10735 to 3.7 from 3.8.
gpshead Aug 30, 2022
f145128
Add What's New entry.
gpshead Aug 30, 2022
00a5114
Hack: Force CI run
tiran Sep 1, 2022
7eaad20
revert 1dae140b610a465b4d3e6fb2109ec13da6093e6d CI hack
gpshead Sep 1, 2022
635e292
Backport ctypes test_macholib fix from b29d0a5a7811418c0a1082ca188fd4…
gpshead Sep 1, 2022
a2956f3
annotate test_bad_password @requires_zlib.
gpshead Sep 1, 2022
95645b6
disable MachOTest.test_find unless macOS 11+ support is backported.
gpshead Sep 1, 2022
2cc321e
Move the whatsnew 3.7.14 text per review.
gpshead Sep 1, 2022
bc83515
LOL at my typo
gpshead Sep 1, 2022
76c9c2b
Make the doctest actually run & fix it.
gpshead Sep 1, 2022
e7bc47e
remove a line that prevents doctest error reporting.
gpshead Sep 2, 2022
0ef7ec0
Fix the docs build.
gpshead Sep 2, 2022
ad13c50
Update the ABI dump with the new private symbols.
gpshead Sep 2, 2022
2788f3f
Merge branch '3.7' into CVE-2020-10735-3.7backport
gpshead Sep 2, 2022
ca92fd2
Rename the news file to appease the Bedevere bot.
gpshead Sep 2, 2022
67905b2
Merge branch 'CVE-2020-10735-3.7backport' of github.com:gpshead/cpyth…
gpshead Sep 2, 2022
db48ddc
hexadecimal spelling =)
gpshead Sep 2, 2022
38ec6a9
Work around Windows Yield macro vs Python-ast.h
gpshead Sep 2, 2022
feaded8
doc typo: limitation
gpshead Sep 4, 2022
c9f2c57
Misc: Fix a typo in the header comment.
gpshead Sep 4, 2022
f69b587
remove unneeded doc note on float.as_integer_ratio
gpshead Sep 4, 2022
39837b6
gh-95778: Correctly pre-check for int-to-str conversion (#96537)
mdickinson Sep 4, 2022
7f911c1
backport cherry pick fix: lookup max from the right place.
gpshead Sep 4, 2022
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
hexadecimal spelling =)
  • Loading branch information
gpshead committed Sep 2, 2022
commit db48ddca2a1241a80af7ad76cbeb3d72036d76a9
6 changes: 3 additions & 3 deletions Doc/library/stdtypes.rst
Original file line number Diff line number Diff line change
Expand Up @@ -4755,7 +4755,7 @@ Integer string conversion length limitation

CPython has a global limit for converting between :class:`int` and :class:`str`
to mitigate denial of service attacks. This limit *only* applies to decimal or
other non-power-of-two number bases. Hexidecimal, octal, and binary conversions
other non-power-of-two number bases. Hexadecimal, octal, and binary conversions
are unlimited. The limit can be configured.

The :class:`int` type in CPython is an abitrary length number stored in binary
Expand Down Expand Up @@ -4792,7 +4792,7 @@ When an operation would exceed the limit, a :exc:`ValueError` is raised:
ValueError: Exceeds the limit (4300) for integer string conversion: value has 8599 digits.
>>> len(hex(i_squared))
7144
>>> assert int(hex(i_squared), base=16) == i*i # Hexidecimal is unlimited.
>>> assert int(hex(i_squared), base=16) == i*i # Hexadecimal is unlimited.

The default limit is 4300 digits as provided in
:data:`sys.int_info.default_max_str_digits <sys.int_info>`.
Expand Down Expand Up @@ -4877,7 +4877,7 @@ Information about the default and minimum can be found in :attr:`sys.int_info`:
encounter an error during parsing, usually at startup time or import time or
even at installation time - anytime an up to date ``.pyc`` does not already
exist for the code. A workaround for source that contains such large
constants is to convert them to ``0x`` hexidecimal form as it has no limit.
constants is to convert them to ``0x`` hexadecimal form as it has no limit.

Test your application thoroughly if you use a low limit. Ensure your tests
run with the limit set early via the environment or flag so that it applies
Expand Down
2 changes: 1 addition & 1 deletion Doc/whatsnew/3.7.rst
Original file line number Diff line number Diff line change
Expand Up @@ -2606,7 +2606,7 @@ Notable security feature in 3.7.14
==================================

Converting between :class:`int` and :class:`str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexidecimal), or 32 such as base 10 (decimal)
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal)
now raises a :exc:`ValueError` if the number of digits in string form is
above a limit to avoid potential denial of service attacks due to the
algorithmic complexity. This is a mitigation for `CVE-2020-10735
Expand Down
2 changes: 1 addition & 1 deletion Lib/test/test_ast.py
Original file line number Diff line number Diff line change
Expand Up @@ -638,7 +638,7 @@ def test_literal_eval_str_int_limit(self):
with self.assertRaises(SyntaxError) as err_ctx:
ast.literal_eval('3'*4001)
self.assertIn('Exceeds the limit ', str(err_ctx.exception))
self.assertIn(' Consider hexidecimal ', str(err_ctx.exception))
self.assertIn(' Consider hexadecimal ', str(err_ctx.exception))

def test_literal_eval_complex(self):
# Issue #4907
Expand Down
2 changes: 1 addition & 1 deletion Lib/test/test_compile.py
Original file line number Diff line number Diff line change
Expand Up @@ -200,7 +200,7 @@ def test_int_literals_too_long(self):
exc = err_ctx.exception
self.assertEqual(exc.lineno, 3)
self.assertIn('Exceeds the limit ', str(exc))
self.assertIn(' Consider hexidecimal ', str(exc))
self.assertIn(' Consider hexadecimal ', str(exc))

def test_unary_minus(self):
# Verify treatment of unary minus on negative numbers SF bug #660455
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
Converting between :class:`int` and :class:`str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexidecimal), or 32 such as base 10 (decimal) now
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a :exc:`ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for `CVE-2020-10735
Expand Down
2 changes: 1 addition & 1 deletion Python/ast.c
Original file line number Diff line number Diff line change
Expand Up @@ -2151,7 +2151,7 @@ ast_for_atom(struct compiling *c, const node *n)
Py_XDECREF(tb);
Py_DECREF(type);
PyObject *helpful_msg = PyUnicode_FromFormat(
"%S - Consider hexidecimal for huge integer literals "
"%S - Consider hexadecimal for huge integer literals "
"to avoid decimal conversion limits.",
value);
if (helpful_msg) {
Expand Down