Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gh-128840: Limit the number of parts in IPv6 address parsing#128841

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
gpshead merged 9 commits intopython:mainfromsethmlarson:ipv6-address-parts
May 24, 2025

Conversation

sethmlarson
Copy link
Contributor

@sethmlarsonsethmlarson commentedJan 14, 2025•
edited
Loading

Copy link

@nessitanessita left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Looks great, thank you@sethmlarson!

sethmlarson reacted with heart emoji
@gpsheadgpshead added needs backport to 3.9only security fixes needs backport to 3.10only security fixes needs backport to 3.11only security fixes needs backport to 3.12only security fixes needs backport to 3.13bugs and security fixes labelsJan 14, 2025
@lazysegtree
Copy link

lazysegtree commentedJan 15, 2025•
edited
Loading

@sethmlarson How does this fix prevents a potential denial-of-service ?

This prevents excessive memory consumption and potential
denial-of-service when parsing a large IPv6 address.

In the case when we end up withip_str with extra:, all this fix causes is that the list created in the split call is shorter (Reduced memory usage, and Less CPU instruction due to prevention of additional append calls to the allocated list).
Even if this fix is not there, program will just consume a bit more memory and a bit more cpu (as@serhiy-storchaka already pointed out, "proportional memory already spent on the input string and proportional time was already spent on reading and decoding it").

And, It should not be labelled "Type-Security" .

@lazysegtree
Copy link

Point to note : this PR is relevant to issue -#128840 , but it doesn't entirely fix the issue.
The issue is

IPv6 addresses have a maximum length (8 colon-separated parts) but the current implementation doesn't limit the length.

This fix just limits the number of: in the address, not the entire address length. A string like this would still be relavant to the issue, and would not be fixed by this.

'0000::' + '0'*(10**4)

And, a complete fix would maybe add a check in_ip_int_from_string method for length ofip_str to be less than or equal to39 (0000:0000:0000:0000:0000:0000:0000:0000)

This check could come in the__init__ method ofIPv6Address class, but that might not be the best place for it.

@sethmlarson
Copy link
ContributorAuthor

@lazysegtree I've made the updates to limit total number of characters in addition to number of splits.

lazysegtree reacted with thumbs up emoji

@hugovk
Copy link
Member

(Updated frommain to fix the unrelated docs CI failure.)

Copy link
Member

@serhiy-storchakaserhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

LGTM. 👍

@python-cla-bot
Copy link

python-cla-botbot commentedApr 18, 2025•
edited
Loading

All commit authors signed the Contributor License Agreement.

CLA signed

@serhiy-storchakaserhiy-storchaka added the needs backport to 3.14bugs and security fixes labelMay 8, 2025
@gpsheadgpshead self-assigned thisMay 24, 2025
@gpsheadgpsheadenabled auto-merge (squash)May 24, 2025 02:36
@gpsheadgpshead merged commit47f1161 intopython:mainMay 24, 2025
39 checks passed
@miss-islington-app
Copy link

Thanks@sethmlarson for the PR, and@gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 24, 2025
…ythonGH-128841)pythonGH-128840: Limit the number of parts in IPv6 address parsingLimit length of IP address string to 39---------(cherry picked from commit 47f1161d3a2bec52b5b5e952150141709c247da2)Co-authored-by: Seth Michael Larson <seth@python.org>Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link

GH-134610 is a backport of this pull request to the3.14 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 24, 2025
…ythonGH-128841)pythonGH-128840: Limit the number of parts in IPv6 address parsingLimit length of IP address string to 39---------(cherry picked from commit47f1161)Co-authored-by: Seth Michael Larson <seth@python.org>Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-appbedevere-appbot removed the needs backport to 3.14bugs and security fixes labelMay 24, 2025
miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 24, 2025
…ythonGH-128841)pythonGH-128840: Limit the number of parts in IPv6 address parsingLimit length of IP address string to 39---------(cherry picked from commit47f1161)Co-authored-by: Seth Michael Larson <seth@python.org>Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link

GH-134611 is a backport of this pull request to the3.13 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.13bugs and security fixes labelMay 24, 2025
@bedevere-app
Copy link

GH-134612 is a backport of this pull request to the3.12 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 24, 2025
…ythonGH-128841)pythonGH-128840: Limit the number of parts in IPv6 address parsingLimit length of IP address string to 39---------(cherry picked from commit47f1161)Co-authored-by: Seth Michael Larson <seth@python.org>Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-appbedevere-appbot removed the needs backport to 3.12only security fixes labelMay 24, 2025
@bedevere-app
Copy link

GH-134613 is a backport of this pull request to the3.11 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 24, 2025
…ythonGH-128841)pythonGH-128840: Limit the number of parts in IPv6 address parsingLimit length of IP address string to 39---------(cherry picked from commit47f1161)Co-authored-by: Seth Michael Larson <seth@python.org>Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-appbedevere-appbot removed the needs backport to 3.11only security fixes labelMay 24, 2025
@bedevere-app
Copy link

GH-134614 is a backport of this pull request to the3.10 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMay 24, 2025
…ythonGH-128841)pythonGH-128840: Limit the number of parts in IPv6 address parsingLimit length of IP address string to 39---------(cherry picked from commit47f1161)Co-authored-by: Seth Michael Larson <seth@python.org>Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-appbedevere-appbot removed the needs backport to 3.10only security fixes labelMay 24, 2025
@bedevere-app
Copy link

GH-134615 is a backport of this pull request to the3.9 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.9only security fixes labelMay 24, 2025
gpshead added a commit that referenced this pull requestMay 24, 2025
…H-128841) (#134610)gh-128840: Limit the number of parts in IPv6 address parsing (GH-128841)GH-128840: Limit the number of parts in IPv6 address parsingLimit length of IP address string to 39---------(cherry picked from commit47f1161)Co-authored-by: Seth Michael Larson <seth@python.org>Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>
gpshead added a commit that referenced this pull requestMay 24, 2025
…H-128841) (#134611)gh-128840: Limit the number of parts in IPv6 address parsing (GH-128841)GH-128840: Limit the number of parts in IPv6 address parsingLimit length of IP address string to 39---------(cherry picked from commit47f1161)Co-authored-by: Seth Michael Larson <seth@python.org>Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@gpsheadgpsheadgpshead left review comments

@nessitanessitanessita approved these changes

@MarkusHMarkusHMarkusH approved these changes

@serhiy-storchakaserhiy-storchakaserhiy-storchaka approved these changes

Assignees

@gpsheadgpshead

Labels
type-securityA security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

7 participants
@sethmlarson@lazysegtree@hugovk@gpshead@nessita@MarkusH@serhiy-storchaka
[8]ページ先頭
©2009-2025 Movatter.jp