Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

gh-144475: Fix a heap buffer overflow in partial_repr#145362

Merged
encukou merged 5 commits intopython:mainfrom
bkap123:partial-repr
Mar 3, 2026
Merged

gh-144475: Fix a heap buffer overflow in partial_repr#145362
encukou merged 5 commits intopython:mainfrom
bkap123:partial-repr

Conversation

@bkap123
Copy link
Contributor

@bkap123bkap123 commentedFeb 28, 2026
edited
Loading

This is a cleaner version of PR#144571. I am not exactly sure what happened in#144571 so I would appreciate if anyone could tell me so I don't make the same mistake again.

Here are the changes I made:

  • I added anargs andkw local pointer so that both live long enough during the call torepr to prevent a segfault
  • I added anfn local pointer so thatrepr uses its original state when generating its final representation.
  • I got rid of theerror goto and merged it with thedone goto as I needed to decrement the reference count offn,args, andkw, and I found that decrementing them in thedone goto was the easiest.
  • I added a test based on@Qanux's original code. I extended it to also check for changes in thefn andkw arguments.

Copy link
Member

@aiskaisk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Sorry, the approval is by accidant. I don't mean to approve this, just have comments this.

bkap123 reacted with thumbs up emoji
@StanFromIrelandStanFromIreland changed the titlegh-144475: Fix a heap buffer overflow in partial_repr (v2)gh-144475: Fix a heap buffer overflow in partial_reprFeb 28, 2026
Copy link
Member

@encukouencukou left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I am not exactly sure what happened in#144571 so I would appreciate if anyone could tell me so I don't make the same mistake again.

Looks like a badgit rebase.
You don't needrebase in CPython, since the PRs are squashed.

for (i = 0; PyDict_Next(pto->kw, &i, &key, &value);) {
for (i = 0; PyDict_Next(kw, &i, &key, &value);) {
/* Prevent key.__str__ from deleting the value. */
Py_INCREF(value);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

If we're covering all the bases:

Here,key can be an arbitrary object as well.

Also, the iteration should have a critical section around it -- seePyDict_Next docs.

But perhaps the best way to solve that would be switching to always usefrozendict with string keys, so let's leave this to a future PR?

Copy link
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Also, the iteration should have a critical section around it -- see PyDict_Next docs.

I think that adding a critical section here is best for a future PR. This PR is more about fixing a mutation duringrepr. In contrast, adding a critical section is intended for the free-threaded build. Additionally, I realized that there are quite a few other times in this file wherePyDict_Next is called without a critical section, so a new PR is needed anyway. I can create an issue for this change, although, should we wait on a PR until this one is merged to avoid any conflicts? I'm fine adding a critical section now, though, if you think that is better.

The one change we could make now is to replaceint i withPy_ssize_t pos as this would make this loop consistent with the docs and other calls toPyDict_Next.

But perhaps the best way to solve that would be switching to always use frozendict with string keys, so let's leave this to a future PR?

I agree, enforcing thatkw has only string keys seems like the best solution. Just to make sure I understand correctly, when you mean switch to using afrozendict, are you saying that thekw entry in thepartialobject struct should be afrozendict instead of adict, or are you referring to something only in this function (partial_repr)? If the former, I would like to work on making that change in a new PR. I’m fairly new to CPython, so I’d appreciate any suggestions you have for that change.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I think that adding a critical section here is best for a future PR.

OK!

are you saying that the kw entry in the partialobject struct should be a frozendict instead of a dict, or are you referring to something only in this function (partial_repr)?

The former seems worth looking into. As you said, there's a lot ofPyDict_Next without critical sections (and other possibilities for possible mutation than threads);frozendict could solve these neatly.

I can create an issue for this change, although, should we wait on a PR until this one is merged to avoid any conflicts?

Yes.

bkap123 reacted with thumbs up emoji
@encukouencukouenabled auto-merge (squash)March 3, 2026 13:20
@encukouencukou added needs backport to 3.13bugs and security fixes needs backport to 3.14bugs and security fixes labelsMar 3, 2026
@encukouencukou merged commit671a953 intopython:mainMar 3, 2026
55 checks passed
@miss-islington-app
Copy link

Thanks@bkap123 for the PR, and@encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull requestMar 3, 2026
…45362)(cherry picked from commit 671a953dd65292a5b69ba7393666ddcac93dbc44)Co-authored-by: bkap123 <97006829+bkap123@users.noreply.github.com>
@miss-islington-app
Copy link

Sorry,@bkap123 and@encukou, I could not cleanly backport this to3.13 due to a conflict.
Please backport usingcherry_picker on command line.

cherry_picker 671a953dd65292a5b69ba7393666ddcac93dbc44 3.13

@bedevere-app
Copy link

GH-145470 is a backport of this pull request to the3.14 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.14bugs and security fixes labelMar 3, 2026
@bkap123bkap123 deleted the partial-repr branchMarch 3, 2026 13:56
encukou pushed a commit that referenced this pull requestMar 3, 2026
GH-145470)(cherry picked from commit671a953)Co-authored-by: bkap123 <97006829+bkap123@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@encukouencukouencukou approved these changes

@rhettingerrhettingerAwaiting requested review from rhettingerrhettinger is a code owner

@aiskaiskAwaiting requested review from aisk

Assignees

@encukouencukou

Labels

needs backport to 3.13bugs and security fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@bkap123@encukou@aisk

[8]ページ先頭

©2009-2026 Movatter.jp