Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

bpo-34656: Avoid relying on signed overflow in _pickle memos.#9261

Merged
benjaminp merged 5 commits into
masterpython/cpython:masterfrom
benjamin-pickle-overflowpython/cpython:benjamin-pickle-overflowCopy head branch name to clipboard
Sep 21, 2018
Merged

bpo-34656: Avoid relying on signed overflow in _pickle memos.#9261
benjaminp merged 5 commits into
masterpython/cpython:masterfrom
benjamin-pickle-overflowpython/cpython:benjamin-pickle-overflowCopy head branch name to clipboard

Conversation

@benjaminp

@benjaminp benjaminp commented Sep 13, 2018

Copy link
Copy Markdown
Contributor

@benjaminp benjaminp force-pushed the benjamin-pickle-overflow branch from ea95daa to 59c974e Compare September 14, 2018 00:54
@benjaminp benjaminp changed the title bpo-1621: Avoid relying on signed overflow in _PyMemoTable_ResizeTable. bpo-34656: Avoid relying on signed overflow in _pickle memos. Sep 14, 2018
Comment thread Modules/_pickle.c Outdated
@@ -7061,7 +7057,7 @@ Unpickler_set_memo(UnpicklerObject *self, PyObject *obj)
error:
if (new_memo_size) {
i = new_memo_size;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like this line is redundant now.

Comment thread Modules/_pickle.c Outdated

/* Find the smallest valid table size >= min_size. */
while (new_size < min_size && new_size > 0)
while (new_size < min_size)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't this cause an infinite loop if min_size > PY_SSIZE_T_MAX?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I will fix.

Comment thread Modules/_pickle.c Outdated
Comment thread Modules/_pickle.c Outdated
*/
if (!(self->mt_used * 3 >= (self->mt_mask + 1) * 2))
size_t triple_used = self->mt_used * 3;
if (triple_used > self->mt_used && triple_used < self->mt_allocated * 2)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

triple_used > self->mt_used

Is this a wrapping/overflow detection?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes

@benjaminp benjaminp force-pushed the benjamin-pickle-overflow branch from 7975314 to d8b389b Compare September 20, 2018 06:06
@benjaminp benjaminp merged commit a4ae828 into master Sep 21, 2018
@miss-islington

Copy link
Copy Markdown
Contributor

Thanks @benjaminp for the PR 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7.
🐍🍒⛏🤖

@benjaminp benjaminp deleted the benjamin-pickle-overflow branch September 21, 2018 01:36
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 21, 2018
…ythonGH-9261)

(cherry picked from commit a4ae828)

Co-authored-by: Benjamin Peterson <benjamin@python.org>
@bedevere-bot

Copy link
Copy Markdown

GH-9465 is a backport of this pull request to the 3.7 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 21, 2018
…ythonGH-9261)

(cherry picked from commit a4ae828)

Co-authored-by: Benjamin Peterson <benjamin@python.org>
@bedevere-bot

Copy link
Copy Markdown

GH-9466 is a backport of this pull request to the 3.6 branch.

miss-islington added a commit that referenced this pull request Sep 21, 2018
…H-9261)

(cherry picked from commit a4ae828)

Co-authored-by: Benjamin Peterson <benjamin@python.org>
miss-islington added a commit that referenced this pull request Sep 21, 2018
…H-9261)

(cherry picked from commit a4ae828)

Co-authored-by: Benjamin Peterson <benjamin@python.org>
larryhastings pushed a commit that referenced this pull request Feb 25, 2019
…H-9261) (#11870)

* bpo-34656: Avoid relying on signed overflow in _pickle memos (GH-9261)

(cherry picked from commit a4ae828)
larryhastings pushed a commit that referenced this pull request Feb 26, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants

Morty Proxy This is a proxified and sanitized view of the page, visit original site.