mirror of
https://github.com/python/cpython.git
synced 2025-07-27 21:24:32 +00:00
Merge in release25-maint r60793:
Added checks for integer overflows, contributed by Google. Some are only available if asserts are left in the code, in cases where they can't be triggered from Python code.
This commit is contained in:
parent
73baefd7fc
commit
9d53457e59
24 changed files with 438 additions and 54 deletions
|
@ -5,8 +5,22 @@ asdl_seq *
|
|||
asdl_seq_new(int size, PyArena *arena)
|
||||
{
|
||||
asdl_seq *seq = NULL;
|
||||
size_t n = sizeof(asdl_seq) +
|
||||
(size ? (sizeof(void *) * (size - 1)) : 0);
|
||||
size_t n = (size ? (sizeof(void *) * (size - 1)) : 0);
|
||||
|
||||
/* check size is sane */
|
||||
if (size < 0 || size == INT_MIN ||
|
||||
(size && ((size - 1) > (PY_SIZE_MAX / sizeof(void *))))) {
|
||||
PyErr_NoMemory();
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* check if size can be added safely */
|
||||
if (n > PY_SIZE_MAX - sizeof(asdl_seq)) {
|
||||
PyErr_NoMemory();
|
||||
return NULL;
|
||||
}
|
||||
|
||||
n += sizeof(asdl_seq);
|
||||
|
||||
seq = (asdl_seq *)PyArena_Malloc(arena, n);
|
||||
if (!seq) {
|
||||
|
@ -22,8 +36,22 @@ asdl_int_seq *
|
|||
asdl_int_seq_new(int size, PyArena *arena)
|
||||
{
|
||||
asdl_int_seq *seq = NULL;
|
||||
size_t n = sizeof(asdl_seq) +
|
||||
(size ? (sizeof(int) * (size - 1)) : 0);
|
||||
size_t n = (size ? (sizeof(void *) * (size - 1)) : 0);
|
||||
|
||||
/* check size is sane */
|
||||
if (size < 0 || size == INT_MIN ||
|
||||
(size && ((size - 1) > (PY_SIZE_MAX / sizeof(void *))))) {
|
||||
PyErr_NoMemory();
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* check if size can be added safely */
|
||||
if (n > PY_SIZE_MAX - sizeof(asdl_seq)) {
|
||||
PyErr_NoMemory();
|
||||
return NULL;
|
||||
}
|
||||
|
||||
n += sizeof(asdl_seq);
|
||||
|
||||
seq = (asdl_int_seq *)PyArena_Malloc(arena, n);
|
||||
if (!seq) {
|
||||
|
|
|
@ -3200,6 +3200,9 @@ decode_unicode(struct compiling *c, const char *s, size_t len, int rawmode, cons
|
|||
buf = (char *)s;
|
||||
u = NULL;
|
||||
} else {
|
||||
/* check for integer overflow */
|
||||
if (len > PY_SIZE_MAX / 4)
|
||||
return NULL;
|
||||
/* "\XX" may become "\u005c\uHHLL" (12 bytes) */
|
||||
u = PyString_FromStringAndSize((char *)NULL, len * 4);
|
||||
if (u == NULL)
|
||||
|
|
|
@ -2792,11 +2792,43 @@ filterstring(PyObject *func, PyObject *strobj)
|
|||
PyString_AS_STRING(item)[0];
|
||||
} else {
|
||||
/* do we need more space? */
|
||||
Py_ssize_t need = j + reslen + len-i-1;
|
||||
Py_ssize_t need = j;
|
||||
|
||||
/* calculate space requirements while checking for overflow */
|
||||
if (need > PY_SSIZE_T_MAX - reslen) {
|
||||
Py_DECREF(item);
|
||||
goto Fail_1;
|
||||
}
|
||||
|
||||
need += reslen;
|
||||
|
||||
if (need > PY_SSIZE_T_MAX - len) {
|
||||
Py_DECREF(item);
|
||||
goto Fail_1;
|
||||
}
|
||||
|
||||
need += len;
|
||||
|
||||
if (need <= i) {
|
||||
Py_DECREF(item);
|
||||
goto Fail_1;
|
||||
}
|
||||
|
||||
need = need - i - 1;
|
||||
|
||||
assert(need >= 0);
|
||||
assert(outlen >= 0);
|
||||
|
||||
if (need > outlen) {
|
||||
/* overallocate, to avoid reallocations */
|
||||
if (need<2*outlen)
|
||||
if (outlen > PY_SSIZE_T_MAX / 2) {
|
||||
Py_DECREF(item);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
if (need<2*outlen) {
|
||||
need = 2*outlen;
|
||||
}
|
||||
if (_PyString_Resize(&result, need)) {
|
||||
Py_DECREF(item);
|
||||
return NULL;
|
||||
|
@ -2888,11 +2920,31 @@ filterunicode(PyObject *func, PyObject *strobj)
|
|||
else {
|
||||
/* do we need more space? */
|
||||
Py_ssize_t need = j + reslen + len - i - 1;
|
||||
|
||||
/* check that didnt overflow */
|
||||
if ((j > PY_SSIZE_T_MAX - reslen) ||
|
||||
((j + reslen) > PY_SSIZE_T_MAX - len) ||
|
||||
((j + reslen + len) < i) ||
|
||||
((j + reslen + len - i) <= 0)) {
|
||||
Py_DECREF(item);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
assert(need >= 0);
|
||||
assert(outlen >= 0);
|
||||
|
||||
if (need > outlen) {
|
||||
/* overallocate,
|
||||
to avoid reallocations */
|
||||
if (need < 2 * outlen)
|
||||
need = 2 * outlen;
|
||||
if (need < 2 * outlen) {
|
||||
if (outlen > PY_SSIZE_T_MAX / 2) {
|
||||
Py_DECREF(item);
|
||||
return NULL;
|
||||
} else {
|
||||
need = 2 * outlen;
|
||||
}
|
||||
}
|
||||
|
||||
if (PyUnicode_Resize(
|
||||
&result, need) < 0) {
|
||||
Py_DECREF(item);
|
||||
|
|
|
@ -216,6 +216,10 @@ _Py_Mangle(PyObject *privateobj, PyObject *ident)
|
|||
return ident; /* Don't mangle if class is just underscores */
|
||||
}
|
||||
plen = strlen(p);
|
||||
|
||||
assert(1 <= PY_SSIZE_T_MAX - nlen);
|
||||
assert(1 + nlen <= PY_SSIZE_T_MAX - plen);
|
||||
|
||||
ident = PyString_FromStringAndSize(NULL, 1 + nlen + plen);
|
||||
if (!ident)
|
||||
return 0;
|
||||
|
@ -621,6 +625,12 @@ compiler_next_instr(struct compiler *c, basicblock *b)
|
|||
size_t oldsize, newsize;
|
||||
oldsize = b->b_ialloc * sizeof(struct instr);
|
||||
newsize = oldsize << 1;
|
||||
|
||||
if (oldsize > (PY_SIZE_MAX >> 1)) {
|
||||
PyErr_NoMemory();
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (newsize == 0) {
|
||||
PyErr_NoMemory();
|
||||
return -1;
|
||||
|
@ -3478,6 +3488,10 @@ assemble_init(struct assembler *a, int nblocks, int firstlineno)
|
|||
a->a_lnotab = PyString_FromStringAndSize(NULL, DEFAULT_LNOTAB_SIZE);
|
||||
if (!a->a_lnotab)
|
||||
return 0;
|
||||
if (nblocks > PY_SIZE_MAX / sizeof(basicblock *)) {
|
||||
PyErr_NoMemory();
|
||||
return 0;
|
||||
}
|
||||
a->a_postorder = (basicblock **)PyObject_Malloc(
|
||||
sizeof(basicblock *) * nblocks);
|
||||
if (!a->a_postorder) {
|
||||
|
@ -3586,10 +3600,14 @@ assemble_lnotab(struct assembler *a, struct instr *i)
|
|||
nbytes = a->a_lnotab_off + 2 * ncodes;
|
||||
len = PyString_GET_SIZE(a->a_lnotab);
|
||||
if (nbytes >= len) {
|
||||
if (len * 2 < nbytes)
|
||||
if ((len <= INT_MAX / 2) && (len * 2 < nbytes))
|
||||
len = nbytes;
|
||||
else
|
||||
else if (len <= INT_MAX / 2)
|
||||
len *= 2;
|
||||
else {
|
||||
PyErr_NoMemory();
|
||||
return 0;
|
||||
}
|
||||
if (_PyString_Resize(&a->a_lnotab, len) < 0)
|
||||
return 0;
|
||||
}
|
||||
|
@ -3608,10 +3626,14 @@ assemble_lnotab(struct assembler *a, struct instr *i)
|
|||
nbytes = a->a_lnotab_off + 2 * ncodes;
|
||||
len = PyString_GET_SIZE(a->a_lnotab);
|
||||
if (nbytes >= len) {
|
||||
if (len * 2 < nbytes)
|
||||
if ((len <= INT_MAX / 2) && len * 2 < nbytes)
|
||||
len = nbytes;
|
||||
else
|
||||
else if (len <= INT_MAX / 2)
|
||||
len *= 2;
|
||||
else {
|
||||
PyErr_NoMemory();
|
||||
return 0;
|
||||
}
|
||||
if (_PyString_Resize(&a->a_lnotab, len) < 0)
|
||||
return 0;
|
||||
}
|
||||
|
@ -3670,6 +3692,8 @@ assemble_emit(struct assembler *a, struct instr *i)
|
|||
if (i->i_lineno && !assemble_lnotab(a, i))
|
||||
return 0;
|
||||
if (a->a_offset + size >= len) {
|
||||
if (len > PY_SSIZE_T_MAX / 2)
|
||||
return 0;
|
||||
if (_PyString_Resize(&a->a_bytecode, len * 2) < 0)
|
||||
return 0;
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue