mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-07-07 19:35:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

gh-135321: Always raise a correct exception for BINSTRING argument > 0x7fffffff in pickle (GH-135322)

Browse source 
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
This commit is contained in:
Justin Applegate 2025-06-11 06:15:12 -04:00 • committed by GitHub
parent 5ae669fc4e
commit 2b8b4774d2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

5
Lib/test/pickletester.py
View file

@ -1100,6 +1100,11 @@ class AbstractUnpickleTests:
self.check_unpickling_error((pickle.UnpicklingError, OverflowError), self.check_unpickling_error((pickle.UnpicklingError, OverflowError),
dumped) dumped)
def test_large_binstring(self):
errmsg = 'BINSTRING pickle has negative byte count'
with self.assertRaisesRegex(pickle.UnpicklingError, errmsg):
self.loads(b'T\0\0\0\x80')
def test_get(self): def test_get(self):
pickled = b'((lp100000\ng100000\nt.' pickled = b'((lp100000\ng100000\nt.'
unpickled = self.loads(pickled) unpickled = self.loads(pickled)

1
Misc/NEWS.d/next/Library/2025-06-10-00-42-30.gh-issue-135321.UHh9jT.rst Normal file
View file

@ -0,0 +1 @@
Raise a correct exception for values greater than 0x7fffffff for the ``BINSTRING`` opcode in the C implementation of :mod:`pickle`.

9
Modules/_pickle.c
View file

@ -5543,17 +5543,16 @@ static int
load_counted_binstring(PickleState *st, UnpicklerObject *self, int nbytes) load_counted_binstring(PickleState *st, UnpicklerObject *self, int nbytes)
{ {
PyObject *obj; PyObject *obj;
Py_ssize_t size; long size;
char *s; char *s;
if (_Unpickler_Read(self, st, &s, nbytes) < 0) if (_Unpickler_Read(self, st, &s, nbytes) < 0)
return -1; return -1;
size = calc_binsize(s, nbytes); size = calc_binint(s, nbytes);
if (size < 0) { if (size < 0) {
PyErr_Format(st->UnpicklingError, PyErr_SetString(st->UnpicklingError,
"BINSTRING exceeds system's maximum size of %zd bytes", "BINSTRING pickle has negative byte count");
PY_SSIZE_T_MAX);
return -1; return -1;
} }