Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-04-14 07:41:00 +00:00
Code Issues Projects Releases Packages Wiki Activity

[3.14] _struct.c: Fix UB from integer overflow in prepare_s (GH-145158) (#145162)

Browse source 
`_struct.c`: Fix UB from integer overflow in `prepare_s` (GH-145158)

Avoid possible undefined behaviour from signed overflow in `struct` module

As discovered via oss-fuzz.
(cherry picked from commit fd0400585e)

Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>
This commit is contained in:
Miss Islington (bot) 2026-02-24 02:18:32 +01:00 • committed by GitHub
parent 1f3ea54368
commit 35a7a6767e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 14 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Lib/test/test_struct.py
View file

@ -552,6 +552,9 @@ def test_count_overflow(self):
hugecount2 = '{}b{}H'.format(sys.maxsize//2, sys.maxsize//2)
self.assertRaises(struct.error, struct.calcsize, hugecount2)
hugecount3 = '{}i{}q'.format(sys.maxsize // 4, sys.maxsize // 8)
self.assertRaises(struct.error, struct.calcsize, hugecount3)
def test_trailing_counter(self):
store = array.array('b', b' '*100)

2
Misc/NEWS.d/next/Library/2026-02-23-20-52-55.gh-issue-145158.vWJtxI.rst Normal file
View file

@ -0,0 +1,2 @@
Avoid undefined behaviour from signed integer overflow when parsing format
strings in the :mod:`struct` module.

10
Modules/_struct.c
View file

@ -1678,7 +1678,15 @@ prepare_s(PyStructObject *self)
case 's': _Py_FALLTHROUGH;
case 'p': len++; ncodes++; break;
case 'x': break;
default: len += num; if (num) ncodes++; break;
default:
if (num > PY_SSIZE_T_MAX - len) {
goto overflow;
}
len += num;
if (num) {
ncodes++;
}
break;
}
itemsize = e->size;