Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

integer overflow in itertools.combinations_with_replacement #67554

Closed
pkt mannequin opened this issue Feb 1, 2015 · 5 comments
Closed

integer overflow in itertools.combinations_with_replacement #67554

pkt mannequin opened this issue Feb 1, 2015 · 5 comments
Labels
type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@pkt
Copy link
Mannequin

pkt mannequin commented Feb 1, 2015

BPO 23365
Nosy @serhiy-storchaka
Files
  • poc_cwr.py
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2015-02-03.07:41:41.144>
created_at = <Date 2015-02-01.13:55:43.723>
labels = ['type-crash']
title = 'integer overflow in itertools.combinations_with_replacement'
updated_at = <Date 2015-02-04.06:09:59.261>
user = 'https://bugs.python.org/pkt'

    bugs.python.org fields:

    activity = <Date 2015-02-04.06:09:59.261>
actor = 'python-dev'
assignee = 'none'
closed = True
closed_date = <Date 2015-02-03.07:41:41.144>
closer = 'serhiy.storchaka'
components = []
creation = <Date 2015-02-01.13:55:43.723>
creator = 'pkt'
dependencies = []
files = ['37964']
hgrepos = []
issue_num = 23365
keywords = []
message_count = 5.0
messages = ['235173', '235217', '235223', '235307', '235376']
nosy_count = 4.0
nosy_names = ['Arfrever', 'python-dev', 'serhiy.storchaka', 'pkt']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue23365'
versions = ['Python 2.7', 'Python 3.3', 'Python 3.4', 'Python 3.5']
    @pkt
    Copy link
    Mannequin Author

    pkt mannequin commented Feb 1, 2015

    # Bug
    # ---
    #
    # static PyObject *
    # cwr_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
    # {
    # ...
    # 1 indices = PyMem_Malloc(r * sizeof(Py_ssize_t));
    # ...
    # for (i=0 ; i<r ; i++)
    # 2 indices[i] = 0;
    #
    #
    # 1. if r=2^30, then r*sizeof(Py_ssize_t)=2^30*2^2=0 (modulo 2^32), so malloc
    # allocates a 0 byte buffer
    # 2. r=2^30>0, so we write well beyond the buffer's end
    #
    # Crash
    # -----
    #
    # Breakpoint 1, cwr_new (type=0x83392a0 <cwr_type>, args=('AA', 1073741824), kwds=0x0) at ./Modules/itertoolsmodule.c:2684
    \bpo-2684 PyObject *pool = NULL;
    # ...
    \bpo-2703 indices = PyMem_Malloc(r * sizeof(Py_ssize_t));
    # (gdb) print r
    # $1 = 1073741824
    # (gdb) print r*4
    # $2 = 0
    # (gdb) c
    # Continuing.
    #
    # Program received signal SIGSEGV, Segmentation fault.
    # 0x0822fdcd in cwr_new (type=0x83392a0 <cwr_type>, args=('AA', 1073741824), kwds=0x0) at ./Modules/itertoolsmodule.c:2710
    \bpo-2710 indices[i] = 0;
    #
    # OS info
    # -------

    # 
# % ./python -V
# Python 3.4.1
#  
# % uname -a
# Linux ubuntu 3.8.0-29-generic #42~precise1-Ubuntu SMP Wed Aug 14 15:31:16 UTC 2013 i686 i686 i386 GNU/Linux
#  
 
import itertools as it
it.combinations_with_replacement("AA", 2**30)

    @pkt pkt mannequin added the type-crash A hard crash of the interpreter, possibly with a core dump label Feb 1, 2015
    @python-dev
    Copy link
    Mannequin

    python-dev mannequin commented Feb 2, 2015

    New changeset 93d445cd5f70 by Benjamin Peterson in branch '3.3':
    check for overflow in combinations_with_replacement (closes bpo-23365)
    https://hg.python.org/cpython/rev/93d445cd5f70

    New changeset 2e7a02e4cf2c by Benjamin Peterson in branch '3.4':
    merge 3.3 (bpo-23365)
    https://hg.python.org/cpython/rev/2e7a02e4cf2c

    New changeset 4d875a690c01 by Benjamin Peterson in branch 'default':
    merge 3.4 (bpo-23365)
    https://hg.python.org/cpython/rev/4d875a690c01

    New changeset 366018a91457 by Benjamin Peterson in branch '2.7':
    check for overflow in combinations_with_replacement (closes bpo-23365)
    https://hg.python.org/cpython/rev/366018a91457

    @python-dev python-dev mannequin closed this as completed Feb 2, 2015
    @serhiy-storchaka
    Copy link
    Member

    The test needs 4GiB. May be use 2**29?

    @python-dev
    Copy link
    Mannequin

    python-dev mannequin commented Feb 3, 2015

    New changeset 356ed025dbae by Serhiy Storchaka in branch '3.3':
    Issues bpo-23363, bpo-23364, bpo-23365, bpo-23366: Fixed itertools overflow tests.
    https://hg.python.org/cpython/rev/356ed025dbae

    New changeset 98c720c3e061 by Serhiy Storchaka in branch '3.4':
    Issues bpo-23363, bpo-23364, bpo-23365, bpo-23366: Fixed itertools overflow tests.
    https://hg.python.org/cpython/rev/98c720c3e061

    New changeset 4cb316fe6bf2 by Serhiy Storchaka in branch 'default':
    Issues bpo-23363, bpo-23364, bpo-23365, bpo-23366: Fixed itertools overflow tests.
    https://hg.python.org/cpython/rev/4cb316fe6bf2

    @python-dev
    Copy link
    Mannequin

    python-dev mannequin commented Feb 4, 2015

    New changeset 887526ebb013 by Serhiy Storchaka in branch '2.7':
    Issues bpo-23363, bpo-23364, bpo-23365, bpo-23366: Fixed itertools overflow tests.
    https://hg.python.org/cpython/rev/887526ebb013

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    type-crash A hard crash of the interpreter, possibly with a core dump
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    1 participant
    @serhiy-storchaka