Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

[security] list_resize(): integer overflow if newsize is too large #97616

Closed
Labels
type-bugAn unexpected behavior, bug, or errortype-securityA security issue
@vstinner

Description

@vstinner

Jordan Limor reported an issue in the C list_resize() function called when a Python list is resized:

When list_resize is hit with the maximum value for a c_ssize_t, the
overallocation strategy causes an overflow in the total allocated bytes.
This results in a call to PyMem_Realloc where the argument is 0 (and one
byte is allocated), but the resulting list's size is set to PY_SSIZE_T_MAX.

Examplebug.py:

importsysimportfaulthandler;faulthandler.enable()x=[0]*65delx[1:]assertlen(x)==1print("resize list",flush=True)max_size= ((2** (tuple.__itemsize__*8)-1)//2)x*=max_sizeprint(f"{len(x)=}")print(f"{sys.getsizeof(x)=}")# crash on reading uninitizalized memoryprint("x[8]=",end="",flush=True)print(x[8])

Output:

$ python3.10 bug.py resize listFatal Python error: Segmentation faultCurrent thread 0x00007fe16ead0740 (most recent call first):  File "bug.py", line 10 in <module>Erreur de segmentation (core dumped)

Metadata

Metadata

Assignees

No one assigned

    Labels

    type-bugAn unexpected behavior, bug, or errortype-securityA security issue

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions


      [8]ページ先頭

      ©2009-2025 Movatter.jp