Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork32k
gh-134070: Prevent out-of-bounds read in mi_clz32 and mi_ctz32#134149
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:main
Are you sure you want to change the base?
Conversation
Most changes to Pythonrequire a NEWS entry. Add one using theblurb_it web app or theblurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Please add a test and blurb.
FYI, this code is fromhttps://github.com/microsoft/mimalloc. You might want to send a pull request there too. |
It's said to be fixed inmicrosoft/mimalloc@ed31847. |
Most changes to Pythonrequire a NEWS entry. Add one using theblurb_it web app or theblurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Please, stop updating two PRs at the same time. Seehttps://devguide.python.org/getting-started/pull-request-lifecycle/. I am going to close the other PR as it only contains the NEWS entry. In addition, please do not merge main into this branch if there is no conflict. TiA. |
I'm trying to add via heroku app but giving server error |
picnixz commentedMay 17, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
I never used the app, so I'd suggest using the command-line instead: python -m pip install blurbpython -m blurbgit commit -m 'blurb' |
@picnixz Thanks for checking. Somehow I missed that commit in mimalloc. |
I think we should copy-paste the change from upstream instead of doing a similar (but not identical) fix here. In other words, copy this code from upstream (from the fix commit) into our |
FixesGH-134070
Summary:
This patch adds a masking operation to the index calculation in
mi_ctz32()andmi_clz32()functions to prevent out-of-bounds access on 64-bit systems, matching the fix from upstream mimalloc.Why:
On systems where
unsigned longis 64-bit, the multiplication may produce a value >31, causing a read outside the array bounds.