mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 17:08:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 13

gh-126862: Use Py_ssize_t instead of int when processing the number of super-classes (#127523)

Browse source
This commit is contained in:
Bénédikt Tran 2025-01-10 04:32:53 +01:00 • committed by GitHub
parent c1417487e9
commit 2fcdc8488c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst Normal file
View file

@ -0,0 +1,2 @@
Fix a possible overflow when a class inherits from an absurd number of
super-classes. Reported by Valery Fedorenko. Patch by Bénédikt Tran.

8
Objects/typeobject.c
View file

@ -2860,7 +2860,7 @@ vectorcall_maybe(PyThreadState *tstate, PyObject *name,
*/
static int
tail_contains(PyObject *tuple, int whence, PyObject *o)
tail_contains(PyObject *tuple, Py_ssize_t whence, PyObject *o)
{
Py_ssize_t j, size;
size = PyTuple_GET_SIZE(tuple);
@ -2923,7 +2923,7 @@ check_duplicates(PyObject *tuple)
*/
static void
set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, int *remain)
set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, Py_ssize_t *remain)
{
Py_ssize_t i, n, off;
char buf[1000];
@ -2978,13 +2978,13 @@ pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size)
{
int res = 0;
Py_ssize_t i, j, empty_cnt;
int *remain;
Py_ssize_t *remain;
/* remain stores an index into each sublist of to_merge.
remain[i] is the index of the next base in to_merge[i]
that is not included in acc.
*/
remain = PyMem_New(int, to_merge_size);
remain = PyMem_New(Py_ssize_t, to_merge_size);
if (remain == NULL) {
PyErr_NoMemory();
return -1;