Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Get rid of dangerous integer overflow tricks #60300

Closed
serhiy-storchaka opened this issue Sep 30, 2012 · 16 comments
Closed

Get rid of dangerous integer overflow tricks #60300

serhiy-storchaka opened this issue Sep 30, 2012 · 16 comments
Assignees
@serhiy-storchaka
Labels
extension-modules C modules in the Modules dir interpreter-core (Objects, Python, Grammar, and Parser dirs) type-bug An unexpected behavior, bug, or error

Comments

@serhiy-storchaka
Copy link
Member

BPO 16096
Nosy @mdickinson, @vstinner, @asvetlov, @serhiy-storchaka
Files
  • size_overflow-3.3.patch: Patch for 3.3 and 3.4
  • size_overflow-3.2.patch: Patch for 3.2
  • size_overflow-2.7.patch: Patch for 2.7
  • size_overflow-2.7_2.patch
  • size_overflow-3.2_2.patch
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/serhiy-storchaka'
closed_at = <Date 2013-01-26.18:56:30.137>
created_at = <Date 2012-09-30.18:34:11.225>
labels = ['extension-modules', 'interpreter-core', 'type-bug']
title = 'Get rid of dangerous integer overflow tricks'
updated_at = <Date 2013-01-26.18:56:30.120>
user = 'https://github.com/serhiy-storchaka'

    bugs.python.org fields:

    activity = <Date 2013-01-26.18:56:30.120>
actor = 'serhiy.storchaka'
assignee = 'serhiy.storchaka'
closed = True
closed_date = <Date 2013-01-26.18:56:30.137>
closer = 'serhiy.storchaka'
components = ['Extension Modules', 'Interpreter Core']
creation = <Date 2012-09-30.18:34:11.225>
creator = 'serhiy.storchaka'
dependencies = []
files = ['27360', '27361', '27362', '28732', '28733']
hgrepos = []
issue_num = 16096
keywords = ['patch']
message_count = 16.0
messages = ['171657', '171993', '171994', '172215', '172218', '172219', '172220', '172221', '172223', '172224', '172227', '172228', '172229', '172283', '180008', '180699']
nosy_count = 6.0
nosy_names = ['mark.dickinson', 'vstinner', 'Arfrever', 'asvetlov', 'python-dev', 'serhiy.storchaka']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue16096'
versions = ['Python 3.3', 'Python 3.4']
    @serhiy-storchaka
    Copy link
    Member Author

    In several places such dungerous code used to check the integer overflow:

      size = n * itemsize;
  if (size / itemsize != n) raise exception...

    Because these values are signed, this results in undefined behavior.

    The proposed patches replace similar unsafe code to safe one. Note that the patches for the different versions are substantially different.

    @serhiy-storchaka serhiy-storchaka added extension-modules C modules in the Modules dir interpreter-core (Objects, Python, Grammar, and Parser dirs) type-bug An unexpected behavior, bug, or error labels Sep 30, 2012
    @asvetlov
    Copy link
    Contributor

    asvetlov commented Oct 4, 2012

    The patches looks good for me, but I like to double check before commit.
    Let's wait for a week for other reviewers.

    @vstinner
    Copy link
    Member

    vstinner commented Oct 4, 2012

    It's maybe safer (and simpler) to not touch such code in Python older than 3.4.

    @mdickinson
    Copy link
    Member

    It's maybe safer (and simpler) to not touch such code in Python
    older than 3.4.

    So far, I've been fixing these overflow bugs only in the development branches, unless they can be shown to cause actual bugs. That said, I think it's probably okay to apply these for 3.3 as well as 3.4, especially since the 3.3 patch is smaller than the others. I'll review and apply.

    @mdickinson mdickinson self-assigned this Oct 6, 2012
    @serhiy-storchaka
    Copy link
    Member Author

    especially since the 3.3 patch is smaller than the others.

    It's becouse 3.3 already contains some fixes which was not be backported to
    older versions.

    @mdickinson
    Copy link
    Member

    It's becouse 3.3 already contains some fixes which was not be backported
    to older versions.

    Yes, exactly! That's what I meant when I said:

    "So far, I've been fixing these overflow bugs only in the development branches"

    There were lots of integer overflow occurrences like these found by John Regehr in bpo-9530. I chose to fix those only in the current development branch, which was 3.3 at the time. Since we've made an effort to clean up 3.3 in that respect, I think it's worth finishing that job off by applying your patch both to 3.3 and 3.4.

    @serhiy-storchaka
    Copy link
    Member Author

    unless they can be shown to cause actual bugs.

    See bpo-14700.

    @mdickinson
    Copy link
    Member

    Serhiy, I don't understand what you're getting at. Can you explain?

    @python-dev
    Copy link
    Mannequin

    python-dev mannequin commented Oct 6, 2012

    New changeset 152d85b2da3a by Mark Dickinson in branch '3.3':
    Issue bpo-16096: Fix several occurrences of potential signed integer overflow. Thanks Serhiy Storchaka.
    http://hg.python.org/cpython/rev/152d85b2da3a

    New changeset faae99459b43 by Mark Dickinson in branch 'default':
    Issue bpo-16096: Merge fixes from 3.3.
    http://hg.python.org/cpython/rev/faae99459b43

    @mdickinson
    Copy link
    Member

    Applied the 3.3 patch to 3.3 and default, with some minor changes:

    • revert the Objects/longobject.c changes, since they don't depend
      on signed overflow

    • fix the second change in Objects/tupleobject.c so that the overflow check happens before the multiplication rather than after.

    @mdickinson
    Copy link
    Member

    Whoops. I take it back about the Objects/longobject.c bit. Fixing ...

    @python-dev
    Copy link
    Mannequin

    python-dev mannequin commented Oct 6, 2012

    New changeset 906ae6485cb8 by Mark Dickinson in branch '3.3':
    Issue bpo-16096: Fix signed overflow in Objects/longobject.c. Thanks Serhiy Storchaka.
    http://hg.python.org/cpython/rev/906ae6485cb8

    New changeset b728aac3bdb3 by Mark Dickinson in branch 'default':
    Issue bpo-16096: port fix from 3.3
    http://hg.python.org/cpython/rev/b728aac3bdb3

    @serhiy-storchaka
    Copy link
    Member Author

    In bpo-14700 were fixed two actual bugs. The fix was not be backported to older
    versions (and this changes included in patches for this issue). I think it is
    better to reopen bpo-14700 for backporting fixes to 2.7 and 3.2?

    @mdickinson
    Copy link
    Member

    Yes, reopening bpo-14700 sounds good to me.

    I'm not against fixing these issues in the bugfix branches, but we need to do it carefully (which unfortunately probably also means slowly). I think that for the bugfix branches, each fix should be accompanied by a test that exercises the original bug. I'd also suggest having a separate issue for each bug, for ease of review.

    I'd probably also prioritise those bugs that can be triggered without having huge structures in memory: e.g., the bpo-14700 bug seems more important to fix than the PyTuple_New bug.

    @mdickinson mdickinson removed their assignment Oct 28, 2012
    @serhiy-storchaka serhiy-storchaka self-assigned this Jan 7, 2013
    @serhiy-storchaka
    Copy link
    Member Author

    Here are updated to current codebase patches for 2.7 and 3.2. It seems that
    all the rest of overflows are hypothetical bugs and do not appear on the
    current supported platforms. Fix them is not necessary (rather for purity). If
    no one can see visible bugs, I'll close this issue soon.

    @serhiy-storchaka
    Copy link
    Member Author

    I withdraw my patches for 2.7 and 3.2 due to the fact that they have no visible effect on supported platforms. Patches for 3.3+ already committed, therefore I close this issue.

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees

    @serhiy-storchaka serhiy-storchaka

    Labels
    extension-modules C modules in the Modules dir interpreter-core (Objects, Python, Grammar, and Parser dirs) type-bug An unexpected behavior, bug, or error
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    4 participants
    @vstinner @asvetlov @mdickinson @serhiy-storchaka