This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: zlibmodule.c: int overflow in PyZlib_decompress
Type: crash Stage:
Components: Extension Modules Versions: Python 3.0, Python 2.6, Python 2.5
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: gvanrossum Nosy List: PeterW, christian.heimes, gvanrossum, nnorwitz
Priority: high Keywords: 64bit, patch

Created on 2007-11-02 10:39 by PeterW, last changed 2022-04-11 14:56 by admin. This issue is now closed.

Files
File name Uploaded Description Edit
int_overflow.diff PeterW, 2007-11-02 10:39
Messages (5)
msg57047 - (view) Author: Peter Weseloh (PeterW) Date: 2007-11-02 10:39
When I use zlib.decompress to decompress a string where the result would
be >1 GB I get
SystemError: Objects/stringobject.c:4089: bad argument to internal function

I tracked that down to an int overflow of r_strlen in PyZlib_decompress.
Using Py_ssize_t instead of int solved this for me (on 64bit Linux).

The patch is against
python/trunk/Modules/zlibmodule.c
Revision: 56476

Kind regards,
Peter
msg57054 - (view) Author: Guido van Rossum (gvanrossum) * (Python committer) Date: 2007-11-02 16:21
I trust that there's a problem, but this can't be right -- the address
of r_strlen is passed to PyArg_ParseTuple corresponding to an 'i' format
letter.  That will never do.
msg57082 - (view) Author: Peter Weseloh (PeterW) Date: 2007-11-03 14:02
You are right. The format should be 'l'. I overlooked that. In my case the
optional 'buf_size' parameter of 'decompress' is not used anyhow.
Shall I change the patch accordingly?

It work well for me and I now checked the code of PyArg_ParseTuple
(Python/getargs.c) to see what happens. As far as I understand, the given
pointer is casted to a pointer to int if the format is 'i' (line  630) . On
a 64 bit machine this leads to a downcast from a (64 bit) long to a (32 bit)
int, which is OK AFAIK, but I could be wrong.

Thanks for pointing that out,
Peter
2007/11/2, Guido van Rossum <report@bugs.python.org>:
>
>
> Guido van Rossum added the comment:
>
> I trust that there's a problem, but this can't be right -- the address
> of r_strlen is passed to PyArg_ParseTuple corresponding to an 'i' format
> letter.  That will never do.
>
> ----------
> assignee:  -> nnorwitz
> nosy: +gvanrossum, nnorwitz
>
> __________________________________
> Tracker <report@bugs.python.org>
> <http://bugs.python.org/issue1372>
> __________________________________
>
msg57091 - (view) Author: Guido van Rossum (gvanrossum) * (Python committer) Date: 2007-11-04 03:38
The correct format for a Py_ssize_t is 'n' (at least in the trunk, I
don't have the 2.5 branch handy but I imagine it's the same).

We can figure out the patch from here.
msg57720 - (view) Author: Christian Heimes (christian.heimes) * (Python committer) Date: 2007-11-21 00:47
Fixed in r59081 and r59080

py3k will follow at the next svnmerge
History
Date User Action Args
2022-04-11 14:56:27adminsetgithub: 45713
2007-11-21 00:47:03christian.heimessetstatus: open -> closed
nosy: + christian.heimes
resolution: fixed
messages: + msg57720
2007-11-20 01:17:22christian.heimessetassignee: nnorwitz -> gvanrossum
2007-11-06 22:36:36gvanrossumsetkeywords: + 64bit
resolution: accepted -> (no value)
2007-11-04 03:38:42gvanrossumsetmessages: + msg57091
2007-11-04 03:36:42gvanrossumsetfiles: - unnamed
2007-11-03 14:02:34PeterWsetfiles: + unnamed
messages: + msg57082
2007-11-02 16:21:25gvanrossumsetassignee: nnorwitz
messages: + msg57054
nosy: + gvanrossum, nnorwitz
2007-11-02 13:24:23christian.heimessetpriority: high
keywords: + patch
resolution: accepted
versions: + Python 2.6, Python 3.0
2007-11-02 10:39:31PeterWcreate