Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Possible undefined behavior division by zero in complex's_Py_c_pow() #113841

Closed
Labels
3.12only security fixes3.13bugs and security fixes3.14bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-bugAn unexpected behavior, bug, or error
@gpshead

Description

@gpshead

Bug report

Bug description:

https://github.com/python/cpython/blob/main/Objects/complexobject.c#L150_Py_c_pow() contains:

at=atan2(a.imag,a.real);phase=at*b.real;if (b.imag!=0.0) {len /=exp(at*b.imag);

An oss-fuzz pycompiler fuzzer identified a problem compiling the code " 9J**33J**3" within the optimizer folding the constant by doing the math in place. We haven't been able to reproduce this ourselves - but code inspection reveals a potential problem:

Cexp(x) can return 0 in a couple of cases. Which would lead to the /= executing an undefined division by zero operation.

I believe the correct_Py_c_pow() code should look something like:

if (b.imag!=0.0) {doubletmp_exp=exp(at*b.imag);if (exp==0.0||errno==ERANGE) {// Detected as OverflowError by our caller.r.real=Py_HUGE_VAL;r.imag=Py_HUGE_VAL;returnr;            }len /=tmp_exp;

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.12only security fixes3.13bugs and security fixes3.14bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-bugAn unexpected behavior, bug, or error

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions


      [8]ページ先頭

      ©2009-2025 Movatter.jp