mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-31 05:58:33 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

[3.9] bpo-43499: Restrict co_code to be under INT_MAX in codeobject (GH-20628) (GH-24896)

Browse source 
(cherry picked from commit 3b3b83c965)
This commit is contained in:
Ammar Askar 2021-03-17 14:26:38 -04:00 • committed by GitHub
parent 1f0cde6784
commit db73376106
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Objects/codeobject.c
View file

@ -166,6 +166,14 @@ PyCode_NewWithPosOnlyArgs(int argcount, int posonlyargcount, int kwonlyargcount,
return NULL; return NULL;
} }
/* Make sure that code is indexable with an int, this is
a long running assumption in ceval.c and many parts of
the interpreter. */
if (PyBytes_GET_SIZE(code) > INT_MAX) {
PyErr_SetString(PyExc_OverflowError, "co_code larger than INT_MAX");
return NULL;
}
/* Check for any inner or outer closure references */ /* Check for any inner or outer closure references */
n_cellvars = PyTuple_GET_SIZE(cellvars); n_cellvars = PyTuple_GET_SIZE(cellvars);
if (!n_cellvars && !PyTuple_GET_SIZE(freevars)) { if (!n_cellvars && !PyTuple_GET_SIZE(freevars)) {

4
Objects/frameobject.c
View file

@ -397,7 +397,9 @@ frame_setlineno(PyFrameObject *f, PyObject* p_new_lineno, void *Py_UNUSED(ignore
return -1; return -1;
} }
int len = PyBytes_GET_SIZE(f->f_code->co_code)/sizeof(_Py_CODEUNIT); /* PyCode_NewWithPosOnlyArgs limits co_code to be under INT_MAX so this
* should never overflow. */
int len = (int)(PyBytes_GET_SIZE(f->f_code->co_code) / sizeof(_Py_CODEUNIT));
int *lines = marklines(f->f_code, len); int *lines = marklines(f->f_code, len);
if (lines == NULL) { if (lines == NULL) {
return -1; return -1;