[Python-checkins] [3.9] gh-97616: list_resize() checks for integer overflow (GH-97617) (GH-97627)
ambv
webhook-mailer at python.org
Tue Oct 4 13:01:15 EDT 2022
https://github.com/python/cpython/commit/f65f3a9daf8e7d0c6c90a86f0c5bbb10ae9191bc
commit: f65f3a9daf8e7d0c6c90a86f0c5bbb10ae9191bc
branch: 3.9
author: Miss Islington (bot) <31488909+miss-islington at users.noreply.github.com>
committer: ambv <lukasz at langa.pl>
date: 2022-10-04T10:01:10-07:00
summary:
[3.9] gh-97616: list_resize() checks for integer overflow (GH-97617) (GH-97627)
gh-97616: list_resize() checks for integer overflow (GH-97617)
Fix multiplying a list by an integer (list *= int): detect the
integer overflow when the new allocated length is close to the
maximum size. Issue reported by Jordan Limor.
list_resize() now checks for integer overflow before multiplying the
new allocated length by the list item size (sizeof(PyObject*)).
(cherry picked from commit a5f092f3c469b674b8d9ccbd4e4377230c9ac7cf)
Co-authored-by: Victor Stinner <vstinner at python.org>
files:
A Misc/NEWS.d/next/Security/2022-09-28-17-09-37.gh-issue-97616.K1e3Xs.rst
M Lib/test/test_list.py
M Objects/listobject.c
diff --git a/Lib/test/test_list.py b/Lib/test/test_list.py
index 3c8d82958fd7..85bbf51e3f99 100644
--- a/Lib/test/test_list.py
+++ b/Lib/test/test_list.py
@@ -68,6 +68,19 @@ def imul(a, b): a *= b
self.assertRaises((MemoryError, OverflowError), mul, lst, n)
self.assertRaises((MemoryError, OverflowError), imul, lst, n)
+ def test_list_resize_overflow(self):
+ # gh-97616: test new_allocated * sizeof(PyObject*) overflow
+ # check in list_resize()
+ lst = [0] * 65
+ del lst[1:]
+ self.assertEqual(len(lst), 1)
+
+ size = ((2 ** (tuple.__itemsize__ * 8) - 1) // 2)
+ with self.assertRaises((MemoryError, OverflowError)):
+ lst * size
+ with self.assertRaises((MemoryError, OverflowError)):
+ lst *= size
+
def test_repr_large(self):
# Check the repr of large list objects
def check(n):
diff --git a/Misc/NEWS.d/next/Security/2022-09-28-17-09-37.gh-issue-97616.K1e3Xs.rst b/Misc/NEWS.d/next/Security/2022-09-28-17-09-37.gh-issue-97616.K1e3Xs.rst
new file mode 100644
index 000000000000..721427fe6465
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2022-09-28-17-09-37.gh-issue-97616.K1e3Xs.rst
@@ -0,0 +1,3 @@
+Fix multiplying a list by an integer (``list *= int``): detect the integer
+overflow when the new allocated length is close to the maximum size. Issue
+reported by Jordan Limor. Patch by Victor Stinner.
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 1e868b43c098..c12c02cbbf6b 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -68,8 +68,14 @@ list_resize(PyListObject *self, Py_ssize_t newsize)
if (newsize == 0)
new_allocated = 0;
- num_allocated_bytes = new_allocated * sizeof(PyObject *);
- items = (PyObject **)PyMem_Realloc(self->ob_item, num_allocated_bytes);
+ if (new_allocated <= (size_t)PY_SSIZE_T_MAX / sizeof(PyObject *)) {
+ num_allocated_bytes = new_allocated * sizeof(PyObject *);
+ items = (PyObject **)PyMem_Realloc(self->ob_item, num_allocated_bytes);
+ }
+ else {
+ // integer overflow
+ items = NULL;
+ }
if (items == NULL) {
PyErr_NoMemory();
return -1;
More information about the Python-checkins
mailing list