Oct 29, 2024 · Oct 29, 2024 · Oct 29, 2024 · Oct 29, 2024 · Oct 29, 2024 · Oct 29, 2024
diff --git a/Lib/test/test_code.py b/Lib/test/test_code.py
    import ctypes
 except ImportError:
    ctypes = None

 try:
    import _testcapi
 except ImportError:
    _testcapi = None

 from test.support import (cpython_only,
                          check_impl_detail, requires_debug_ranges,
                          gc_collect, Py_GIL_DISABLED)
                    with self.assertRaises(Exception):
                        _testinternalcapi.verify_stateless_code(func)

    @unittest.skipUnless(ctypes, "requires ctypes")
    @unittest.skipUnless(_testcapi, "requires _testcapi")
    def test_co_framesize_overflow(self):
        # See: https://github.com/python/cpython/issues/126119.

        def foo(a, b):
            x = a * b
            return x

        c = foo.__code__

        # The exact limit depends on co_nlocalsplus, so we do not hardcode it.
        too_large_stacksize = _testcapi.INT_MAX // 16
        ok_stacksize = too_large_stacksize // 2

        with self.assertRaisesRegex(OverflowError, "stack size is too large"):
            c.__replace__(co_stacksize=too_large_stacksize)
        c.__replace__(co_stacksize=ok_stacksize)


 def isinterned(s):
    return s is sys.intern(('_' + s + '_')[1:-1])
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2024-10-29-11-47-19.gh-issue-126119.xbAvxt.rst b/Misc/NEWS.d/next/Core_and_Builtins/2024-10-29-11-47-19.gh-issue-126119.xbAvxt.rst
 Fix a crash in DEBUG builds due to a lack of overflow checks when setting
 the :attr:`co_stacksize <codeobject.co_stacksize>` field of a :ref:`code
 object <code-objects>` via :meth:`~object.__replace__`.
 Reported by Valery Fedorenko. Patch by Bénédikt Tran.
diff --git a/Objects/codeobject.c b/Objects/codeobject.c
        PyErr_SetString(PyExc_ValueError, "code: co_varnames is too small");
        return -1;
    }

    /*
     * Since framesize = stacksize + nlocalsplus + FRAME_SPECIALS_SIZE is used
     * as framesize * sizeof(PyObject *) and assumed to be < INT_MAX in many
     * other places, we need to limit stacksize + nlocalsplus in order to
     * avoid overflows.
     *
     * See https://github.com/python/cpython/issues/126119 for details
     * and corresponding PR for the rationale on the upper limit value.
     */
    Py_ssize_t limit = (Py_ssize_t)(INT_MAX / 16);
    Py_ssize_t nlocalsplus = PyTuple_GET_SIZE(con->localsplusnames);
    if (nlocalsplus >= limit || con->stacksize >= limit - nlocalsplus) {
        PyErr_SetString(PyExc_OverflowError,
                        "code: locals + stack size is too large");
        return -1;
    }
    return 0;
 }
Original file line number	Diff line number	Diff line change
Expand Up		@@ -208,6 +208,12 @@
		import ctypes
		except ImportError:
		ctypes = None

		try:
		import _testcapi
		except ImportError:
		_testcapi = None

		from test.support import (cpython_only,
		check_impl_detail, requires_debug_ranges,
		gc_collect, Py_GIL_DISABLED)
Expand DownExpand Up		@@ -1159,6 +1165,25 @@ def test_stateless(self):
		with self.assertRaises(Exception):
		_testinternalcapi.verify_stateless_code(func)

		@unittest.skipUnless(ctypes, "requires ctypes")
		@unittest.skipUnless(_testcapi, "requires _testcapi")
		def test_co_framesize_overflow(self):
		# See: https://github.com/python/cpython/issues/126119.

		def foo(a, b):
		x = a * b
		return x

		c = foo.__code__

		# The exact limit depends on co_nlocalsplus, so we do not hardcode it.
		too_large_stacksize = _testcapi.INT_MAX // 16
		ok_stacksize = too_large_stacksize // 2

		with self.assertRaisesRegex(OverflowError, "stack size is too large"):
		c.__replace__(co_stacksize=too_large_stacksize)
		c.__replace__(co_stacksize=ok_stacksize)


		def isinterned(s):
		return s is sys.intern(('_' + s + '_')[1:-1])
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,4 @@
		Fix a crash in DEBUG builds due to a lack of overflow checks when setting
		the :attr:`co_stacksize <codeobject.co_stacksize>` field of a :ref:`code
		object <code-objects>` via :meth:`~object.__replace__`.
		Reported by Valery Fedorenko. Patch by Bénédikt Tran.
Original file line number	Diff line number	Diff line change
Expand Up		@@ -495,7 +495,22 @@ _PyCode_Validate(struct _PyCodeConstructor *con)
		PyErr_SetString(PyExc_ValueError, "code: co_varnames is too small");
		return -1;
		}

		/*
		* Since framesize = stacksize + nlocalsplus + FRAME_SPECIALS_SIZE is used
		* as framesize * sizeof(PyObject *) and assumed to be < INT_MAX in many
		* other places, we need to limit stacksize + nlocalsplus in order to
		* avoid overflows.
		*
		* See https://github.com/python/cpython/issues/126119 for details
		* and corresponding PR for the rationale on the upper limit value.
		*/
		Py_ssize_t limit = (Py_ssize_t)(INT_MAX / 16);
		Py_ssize_t nlocalsplus = PyTuple_GET_SIZE(con->localsplusnames);
		if (nlocalsplus >= limit \|\| con->stacksize >= limit - nlocalsplus) {
		PyErr_SetString(PyExc_OverflowError,
		"code: locals + stack size is too large");
		return -1;
		}
		return 0;
		}

Expand Down