Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Array out of bounds assignment in list_ass_subscript #120384

Closed
Labels
3.12only security fixes3.13bugs and security fixes3.14bugs and security fixestype-crashA hard crash of the interpreter, possibly with a core dump
@MechanicPig

Description

@MechanicPig

Crash report

What happened?

Root Cause

When step is not 1 in slice assignment,list_ass_subscript first calculates the length of the slice and then converts the input iterable into a list. During the conversion, arbitrary code in Python can be executed to modify the length of the current list or even clear it:

/* Python 3.10 source code */staticintlist_ass_subscript(PyListObject*self,PyObject*item,PyObject*value){if (_PyIndex_Check(item)) {/* ... */ }elseif (PySlice_Check(item)) {Py_ssize_tstart,stop,step,slicelength;if (PySlice_Unpack(item,&start,&stop,&step)<0) {return-1;        }slicelength=PySlice_AdjustIndices(Py_SIZE(self),&start,&stop,step);if (step==1)returnlist_ass_slice(self,start,stop,value);/* Make sure s[5:2] = [..] inserts at the right place:           before 5, not before 2. */if ((step<0&&start<stop)||            (step>0&&start>stop))stop=start;if (value==NULL) {/* ... */ }else {/* assign slice */PyObject*ins,*seq;PyObject**garbage,**seqitems,**selfitems;Py_ssize_ti;size_tcur;/* protect against a[::-1] = a */if (self== (PyListObject*)value) {seq=list_slice((PyListObject*)value,0,PyList_GET_SIZE(value));            }else {seq=PySequence_Fast(value,// <-- call arbitrary code in python"must assign iterable ""to extended slice");            }if (!seq)return-1;/* ... */selfitems=self->ob_item;seqitems=PySequence_Fast_ITEMS(seq);for (cur=start,i=0;i<slicelength;cur+= (size_t)step,i++) {garbage[i]=selfitems[cur];ins=seqitems[i];Py_INCREF(ins);selfitems[cur]=ins;// <-- maybe out of bounds            }/* ... */        }/* ... */}

POC

classevil:def__init__(self,lst):self.lst=lstdef__iter__(self):yieldfromself.lstself.lst.clear()lst=list(range(10))lst[::-1]=evil(lst)

CPython versions tested on:

3.10, 3.11, 3.12

Operating systems tested on:

Windows

Output from running 'python -VV' on the command line:

Python 3.10.11 (tags/v3.10.11:7d4cc5a, Apr 5 2023, 00:38:17) [MSC v.1929 64 bit (AMD64)]
Python 3.11.8 (tags/v3.11.8:db85d51, Feb 6 2024, 22:03:32) [MSC v.1937 64 bit (AMD64)]
Python 3.12.3 (tags/v3.12.3:f6650f9, Apr 9 2024, 14:05:25) [MSC v.1938 64 bit (AMD64)]

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.12only security fixes3.13bugs and security fixes3.14bugs and security fixestype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions


      [8]ページ先頭

      ©2009-2025 Movatter.jp