Possible overflow in typeobject.c:tail_contains

Bug report

Bug description:

whence+1 could lead to overflow for large value of whence. I think changing type from int to Py_ssize_t could fix the problem (remain is input parameter):

static int
pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size)
{
...
    remain = PyMem_New(Py_ssize_t, to_merge_size);

CPython versions tested on:

3.11

Operating systems tested on:

Linux

Linked PRs

gh-126862: Use Py_ssize_t instead of int when processing the number of super-classes #127523
[3.13] gh-126862: Use Py_ssize_t instead of int when processing the number of super-classes (GH-127523) #128699
[3.12] gh-126862: Use Py_ssize_t instead of int when processing the number of super-classes (GH-127523) #128700

This one is used in

        candidate = PyTuple_GET_ITEM(cur_tuple, remain[i]);
        for (j = 0; j < to_merge_size; j++) {
            PyObject *j_lst = to_merge[j];
            if (tail_contains(j_lst, remain[j], candidate))
                goto skip; /* continue outer loop */
        }

and for the MRO resolution. Unless we have a VERY huge list of parent classes, I don't think we would hit the overflow.

@JelleZijlstra

cc @JelleZijlstra

@picnixz

@picnixz , should I try to overflow inheritance list? :) Or is there already protection against this?

Yes, if you can make it happen! (I don't know whether there's a protection)

For this to trigger you'd need a class with over 2**32 base classes, right? I currently have a Python terminal open where I'm trying to generate 2**32 classes to test this, and it's been running for more than half an hour already. It's probably OK to change int to Py_ssize_t here for cleanliness, but let's not add a unit test that attempts to trigger this condition.

gh-126862: Use `Py_ssize_t` instead of `int` when processing the numb…

pythongh-126862: Use `Py_ssize_t` instead of `int` when processing th…

[3.12] gh-126862: Use `Py_ssize_t` instead of `int` when processing t…

[3.13] gh-126862: Use `Py_ssize_t` instead of `int` when processing t…

I'll close this one as completed since we changed int to Py_ssize_t for cleanliness (well, whence + 1 could still overflow, but this is in the infeasible realm)

Navigation Menu

Repository navigation

Possible overflow in typeobject.c:tail_contains #126862

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Possible overflow in typeobject.c:tail_contains #126862

Description

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

Activity

picnixz commented on Nov 15, 2024

picnixz commented on Nov 15, 2024

federicovalenso commented on Nov 15, 2024

picnixz commented on Nov 15, 2024

JelleZijlstra commented on Nov 15, 2024

picnixz commented on Jan 11, 2025

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions