Commit graph

13 commits

Author SHA1 Message Date
Gregory P. Smith
cec1e9dfd7
[3.9] gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96502)
* Correctly pre-check for int-to-str conversion (#96537)

Converting a large enough `int` to a decimal string raises `ValueError` as expected. However, the raise comes _after_ the quadratic-time base-conversion algorithm has run to completion. For effective DOS prevention, we need some kind of check before entering the quadratic-time loop. Oops! =)

The quick fix: essentially we catch _most_ values that exceed the threshold up front. Those that slip through will still be on the small side (read: sufficiently fast), and will get caught by the existing check so that the limit remains exact.

The justification for the current check. The C code check is:
```c
max_str_digits / (3 * PyLong_SHIFT) <= (size_a - 11) / 10
```

In GitHub markdown math-speak, writing $M$ for `max_str_digits`, $L$ for `PyLong_SHIFT` and $s$ for `size_a`, that check is:
$$\left\lfloor\frac{M}{3L}\right\rfloor \le \left\lfloor\frac{s - 11}{10}\right\rfloor$$

From this it follows that
$$\frac{M}{3L} < \frac{s-1}{10}$$
hence that
$$\frac{L(s-1)}{M} > \frac{10}{3} > \log_2(10).$$
So
$$2^{L(s-1)} > 10^M.$$
But our input integer $a$ satisfies $|a| \ge 2^{L(s-1)}$, so $|a|$ is larger than $10^M$. This shows that we don't accidentally capture anything _below_ the intended limit in the check.

<!-- gh-issue-number: gh-95778 -->
* Issue: gh-95778
<!-- /gh-issue-number -->

Co-authored-by: Gregory P. Smith [Google LLC] <greg@krypto.org>
Co-authored-by: Christian Heimes <christian@python.org>
Co-authored-by: Mark Dickinson <dickinsm@gmail.com>
2022-09-05 11:21:03 +02:00
Inada Naoki
5492bfcefe
bpo-39377: json: Remove the encoding option. (GH-18075) 2020-01-20 13:54:00 +09:00
Matthias Bussonnier
a8abe097c1 bpo-33461: emit DeprecationWarning when json.loads(encoding=...) is used (GH-6762) 2019-04-09 16:17:25 +09:00
Serhiy Storchaka
ae00fb1d4f
bpo-30877: Fix clearing a cache in the the JSON decoder. (GH-7048) 2018-05-22 14:55:07 +03:00
Victor Stinner
d6debb24e0 bpo-29919: Remove unused imports found by pyflakes (#137)
Make also minor PEP8 coding style fixes on modified imports.
2017-03-27 16:05:26 +02:00
Nick Coghlan
b161562f72 Issue #17909: Accept binary input in json.loads
json.loads (and hence json.load) now support binary input
encoded as UTF-8, UTF-16 or UTF-32.

Patch by Serhiy Storchaka.
2016-09-10 20:16:18 +10:00
Martin Panter
0f0eac431f Issue #27993: Fix problems with plural objects in docs and comments 2016-09-07 11:04:41 +00:00
Serhiy Storchaka
47efb4a5dc Issue #19361: JSON decoder now raises JSONDecodeError instead of ValueError. 2015-01-26 13:16:30 +02:00
Benjamin Peterson
584f5cbf16 merge 3.3 2014-04-13 22:31:42 -04:00
Benjamin Peterson
156285c35f merge 3.2 2014-04-13 22:28:16 -04:00
Ezio Melotti
566a2be95c #18958: Improve error message for json.load(s) while passing a string that starts with a UTF-8 BOM. 2013-10-21 02:10:55 +03:00
Ezio Melotti
a0e768ccc2 #19307: Improve error message for json.load(s) while passing objects of the wrong type. 2013-10-21 01:52:33 +03:00
Ezio Melotti
66f2ea042a #18273: move the tests in Lib/test/json_tests to Lib/test/test_json and make them discoverable by unittest. Patch by Zachary Ware. 2013-08-08 15:03:45 +03:00
Renamed from Lib/test/json_tests/test_decode.py (Browse further)