Skip to content

[3.8] gh-97616: list_resize() checks for integer overflow (GH-97617) - #97628

Merged
ambv merged 1 commit into
python:3.8from
miss-islington:backport-a5f092f-3.8
Oct 4, 2022
Merged

[3.8] gh-97616: list_resize() checks for integer overflow (GH-97617)#97628
ambv merged 1 commit into
python:3.8from
miss-islington:backport-a5f092f-3.8

Conversation

@miss-islington

@miss-islington miss-islington commented Sep 28, 2022

Copy link
Copy Markdown
Contributor

Fix multiplying a list by an integer (list *= int): detect the
integer overflow when the new allocated length is close to the
maximum size. Issue reported by Jordan Limor.

list_resize() now checks for integer overflow before multiplying the
new allocated length by the list item size (sizeof(PyObject*)).
(cherry picked from commit a5f092f)

Co-authored-by: Victor Stinner vstinner@python.org

…7617)

Fix multiplying a list by an integer (list *= int): detect the
integer overflow when the new allocated length is close to the
maximum size.  Issue reported by Jordan Limor.

list_resize() now checks for integer overflow before multiplying the
new allocated length by the list item size (sizeof(PyObject*)).
(cherry picked from commit a5f092f)

Co-authored-by: Victor Stinner <vstinner@python.org>

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, good bot.

@miss-islington

Copy link
Copy Markdown
Contributor Author

Status check is done, and it's a success ✅.

@miss-islington

Copy link
Copy Markdown
Contributor Author

Sorry, I can't merge this PR. Reason: You're not authorized to push to this branch. Visit https://docs.github.com/articles/about-protected-branches/ for more information..

@ambv
ambv merged commit f9ce9d4 into python:3.8 Oct 4, 2022
@miss-islington
miss-islington deleted the backport-a5f092f-3.8 branch October 4, 2022 17:08
@myk0d3

myk0d3 commented Apr 5, 2023

Copy link
Copy Markdown

I'm confused by the change to file Objects/listobject.c because the added test (line 69), apparently has the same exact effect of the previously existing (and kept) test at line 62. Probably I miss something because, apparently line 75 can never be reached.
Original fix and its backport on versions 3.11 , 3.10 and 3.9 is clear, but was it really required for versions 3.8 and 3.7 ?

@vstinner

vstinner commented Apr 6, 2023

Copy link
Copy Markdown
Member

I'm confused by the change to file Objects/listobject.c because the added test (line 69), apparently has the same exact effect of the previously existing (and kept) test at line 62.

Oh. I blindly and automatically backported my change from the main branch, without checking if old versions were really vulnerable.

It seems like commit 2fe815e changed list_resize() code in 2020: in Python 3.9.0. So it seems like Python 3.8 wasn't impacted that the issue #97616.

So the backport to Python 3.8 was not useful, but I don't think that it's useful to undo this backport.

@myk0d3

myk0d3 commented Apr 10, 2023

Copy link
Copy Markdown

Thank you for spending time to provide your feedback. I don't see any need to undo the backport too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type-security A security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants