Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-12-31 04:23:37 +00:00
Code Issues Projects Releases Packages Wiki Activity

gh-101037: Fix potential memory underallocation for zeros of int subtypes (#101038)

Browse source 
This PR fixes object allocation in long_subtype_new to ensure that there's at least one digit in all cases, and makes sure that the value of that digit is copied over from the source long.

Needs backport to 3.11, but not any further: the change to require at least one digit was only introduced for Python 3.11.

Fixes #101037.
This commit is contained in:
Mark Dickinson 2023-01-21 10:23:59 +00:00 • committed by GitHub
parent 9e947675ae
commit 401fdf9c85
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Include/cpython/longintrepr.h
View file

@ -71,6 +71,9 @@ typedef long stwodigits; /* signed variant of twodigits */
0 <= ob_digit[i] <= MASK.
The allocation function takes care of allocating extra memory
so that ob_digit[0] ... ob_digit[abs(ob_size)-1] are actually available.
We always allocate memory for at least one digit, so accessing ob_digit[0]
is always safe. However, in the case ob_size == 0, the contents of
ob_digit[0] may be undefined.
CAUTION: Generic code manipulating subtypes of PyVarObject has to
aware that ints abuse ob_size's sign bit.

2
Misc/NEWS.d/next/Core and Builtins/2023-01-14-17-03-08.gh-issue-101037.9ATNuf.rst Normal file
View file

@ -0,0 +1,2 @@
Fix potential memory underallocation issue for instances of :class:`int`
subclasses with value zero.

5
Objects/longobject.c
View file

@ -5638,6 +5638,11 @@ long_subtype_new(PyTypeObject *type, PyObject *x, PyObject *obase)
n = Py_SIZE(tmp);
if (n < 0)
n = -n;
/* Fast operations for single digit integers (including zero)
* assume that there is always at least one digit present. */
if (n == 0) {
n = 1;
}
newobj = (PyLongObject *)type->tp_alloc(type, n);
if (newobj == NULL) {
Py_DECREF(tmp);