mirror of
https://github.com/python/cpython.git
synced 2025-08-04 08:59:19 +00:00
eace09e63e
Converting a large enough `int` to a decimal string raises `ValueError` as expected. However, the raise comes _after_ the quadratic-time base-conversion algorithm has run to completion. For effective DOS prevention, we need some kind of check before entering the quadratic-time loop. Oops! =)
The quick fix: essentially we catch _most_ values that exceed the threshold up front. Those that slip through will still be on the small side (read: sufficiently fast), and will get caught by the existing check so that the limit remains exact.
The justification for the current check. The C code check is:
```c
max_str_digits / (3 * PyLong_SHIFT) <= (size_a - 11) / 10
```
In GitHub markdown math-speak, writing $M$ for `max_str_digits`, $L$ for `PyLong_SHIFT` and $s$ for `size_a`, that check is:
$$\left\lfloor\frac{M}{3L}\right\rfloor \le \left\lfloor\frac{s - 11}{10}\right\rfloor$$
From this it follows that
$$\frac{M}{3L} < \frac{s-1}{10}$$
hence that
$$\frac{L(s-1)}{M} > \frac{10}{3} > \log_2(10).$$
So
$$2^{L(s-1)} > 10^M.$$
But our input integer $a$ satisfies $|a| \ge 2^{L(s-1)}$, so $|a|$ is larger than $10^M$. This shows that we don't accidentally capture anything _below_ the intended limit in the check.
<!-- gh-issue-number: gh-95778 -->
* Issue: gh-95778
<!-- /gh-issue-number -->
Co-authored-by: Gregory P. Smith [Google LLC] <greg@krypto.org>
(cherry picked from commit b126196838)
Co-authored-by: Mark Dickinson <dickinsm@gmail.com>
75 lines
2.5 KiB
C
75 lines
2.5 KiB
C
#ifndef Py_INTERNAL_LONG_H
|
|
#define Py_INTERNAL_LONG_H
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
#ifndef Py_BUILD_CORE
|
|
# error "this header requires Py_BUILD_CORE define"
|
|
#endif
|
|
|
|
#include "pycore_interp.h" // PyInterpreterState.small_ints
|
|
#include "pycore_pystate.h" // _PyThreadState_GET()
|
|
|
|
/*
|
|
* Default int base conversion size limitation: Denial of Service prevention.
|
|
*
|
|
* Chosen such that this isn't wildly slow on modern hardware and so that
|
|
* everyone's existing deployed numpy test suite passes before
|
|
* https://github.com/numpy/numpy/issues/22098 is widely available.
|
|
*
|
|
* $ python -m timeit -s 's = "1"*4300' 'int(s)'
|
|
* 2000 loops, best of 5: 125 usec per loop
|
|
* $ python -m timeit -s 's = "1"*4300; v = int(s)' 'str(v)'
|
|
* 1000 loops, best of 5: 311 usec per loop
|
|
* (zen2 cloud VM)
|
|
*
|
|
* 4300 decimal digits fits a ~14284 bit number.
|
|
*/
|
|
#define _PY_LONG_DEFAULT_MAX_STR_DIGITS 4300
|
|
/*
|
|
* Threshold for max digits check. For performance reasons int() and
|
|
* int.__str__() don't checks values that are smaller than this
|
|
* threshold. Acts as a guaranteed minimum size limit for bignums that
|
|
* applications can expect from CPython.
|
|
*
|
|
* % python -m timeit -s 's = "1"*640; v = int(s)' 'str(int(s))'
|
|
* 20000 loops, best of 5: 12 usec per loop
|
|
*
|
|
* "640 digits should be enough for anyone." - gps
|
|
* fits a ~2126 bit decimal number.
|
|
*/
|
|
#define _PY_LONG_MAX_STR_DIGITS_THRESHOLD 640
|
|
|
|
#if ((_PY_LONG_DEFAULT_MAX_STR_DIGITS != 0) && \
|
|
(_PY_LONG_DEFAULT_MAX_STR_DIGITS < _PY_LONG_MAX_STR_DIGITS_THRESHOLD))
|
|
# error "_PY_LONG_DEFAULT_MAX_STR_DIGITS smaller than threshold."
|
|
#endif
|
|
|
|
// Don't call this function but _PyLong_GetZero() and _PyLong_GetOne()
|
|
static inline PyObject* __PyLong_GetSmallInt_internal(int value)
|
|
{
|
|
PyInterpreterState *interp = _PyInterpreterState_GET();
|
|
assert(-_PY_NSMALLNEGINTS <= value && value < _PY_NSMALLPOSINTS);
|
|
size_t index = _PY_NSMALLNEGINTS + value;
|
|
PyObject *obj = (PyObject*)interp->small_ints[index];
|
|
// _PyLong_GetZero(), _PyLong_GetOne() and get_small_int() must not be
|
|
// called before _PyLong_Init() nor after _PyLong_Fini().
|
|
assert(obj != NULL);
|
|
return obj;
|
|
}
|
|
|
|
// Return a borrowed reference to the zero singleton.
|
|
// The function cannot return NULL.
|
|
static inline PyObject* _PyLong_GetZero(void)
|
|
{ return __PyLong_GetSmallInt_internal(0); }
|
|
|
|
// Return a borrowed reference to the one singleton.
|
|
// The function cannot return NULL.
|
|
static inline PyObject* _PyLong_GetOne(void)
|
|
{ return __PyLong_GetSmallInt_internal(1); }
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
#endif /* !Py_INTERNAL_LONG_H */
|