Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Some object-to-AST conversions are missing error checks #105588

Copy link
Copy link
@brandtbucher

Description

@brandtbucher
Issue body actions

The generated code in Python-ast.c is missing error checks following the construction of C-level alias, arg, comprehension, keyword, match_item, and withitem nodes from their Python object counterparts. This means it's possible to crash the interpreter by attempting to compile an AST where a required member of these nodes is replaced with None:

>>> import ast
>>> tree = ast.parse("""
... match ...:
...     case THIS:
...         ...
... """)
>>> tree.body[0].cases[0].pattern = None
>>> compile(tree, "<crash>", "exec")
Segmentation fault

I'll have a PR up in a minute with the one-line fix.

Linked PRs

Reactions are currently unavailable

Metadata

Metadata

Assignees

Labels

3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13bugs and security fixesbugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)triagedThe issue has been accepted as valid by a triager.The issue has been accepted as valid by a triager.type-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

    Morty Proxy This is a proxified and sanitized view of the page, visit original site.