Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gh-136053: Memory Safety Issue in marshal.c TYPE_SLICE Case#136054

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Open
akshat62 wants to merge15 commits intopython:main
base:main
Choose a base branch
Loading
fromakshat62:gh-136053/memory-saferty-TYPE_SLICE

Conversation

akshat62
Copy link
Contributor

@akshat62akshat62 commentedJun 27, 2025•
edited by bedevere-appbot
Loading

Copy link
Member

@picnixzpicnixz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

cc@serhiy-storchaka

Would it be possible to add a test with a maliciously crafted data so that we ensure that the vulnerability can be exploited?

ZeroIntensity reacted with thumbs up emoji
@picnixz
Copy link
Member

Thanks for the fix but please add a regression test. Even if it's not easily reproducible, I'd like to see a PoC.

akshat62 reacted with thumbs up emoji

@serhiy-storchakaserhiy-storchaka self-requested a reviewJune 28, 2025 09:26
Copy link
Member

@serhiy-storchakaserhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The test does not work.

For testing, you need to create at least 2147483646 (0x7ffffffe) references. This is impossible on 32-bit platform, and on 64-bit platforms it will consume at least 16 GiB (and maybe 32 GiB or 64 GiB due to overallocation) only for the list, not counting the referred objects. This is a bigmem test. This will also take a significant amount of time to run. I do not think it is worth to add an expensive test for trivial fix.

Comment on lines +619 to +623
# This tests the case where r_ref_reserve fails when processing TYPE_SLICE with FLAG_REF
# We simulate a scenario where the reference list is too large

# Create malformed marshal data: TYPE_SLICE with FLAG_REF but invalid reference handling
# This should trigger the r_ref_reserve failure path and be handled gracefully

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Too long lines.

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@serhiy-storchakaserhiy-storchakaserhiy-storchaka left review comments

@sobolevnsobolevnsobolevn left review comments

@picnixzpicnixzpicnixz left review comments

Assignees
No one assigned
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

4 participants
@akshat62@picnixz@serhiy-storchaka@sobolevn
[8]ページ先頭
©2009-2025 Movatter.jp