◐ Shell
reader mode source ↗
Skip to content

bpo-34087: Fix buffer overflow in int(s) and similar functions#8274

Merged
methane merged 4 commits into
python:masterfrom
methane:missing-nul
Jul 14, 2018
Merged

bpo-34087: Fix buffer overflow in int(s) and similar functions#8274
methane merged 4 commits into
python:masterfrom
methane:missing-nul

Conversation

@methane

@methane methane commented Jul 13, 2018 •
edited by bedevere-bot
Loading

Copy link
Copy Markdown
Member

_PyUnicode_TransformDecimalAndSpaceToASCII() missed trailing NUL char.
It cause buffer overflow in _Py_string_to_number_with_underscores().

This bug is introduced in bpo-31979, 9b6c60c.

https://bugs.python.org/issue34087

methane added 2 commits July 13, 2018 22:03
@methane
Fix int(s) and similar function may break memory …
dfd63aa 
_PyUnicode_TransformDecimalAndSpaceToASCII() missed trailing NUL char.
It cause buffer overflow in _Py_string_to_number_with_underscores().

This bug is introduced in bpo-31979, 9b6c60c.
@methane
Add NEWS
46d4225
@methane methane added type-bug An unexpected behavior, bug, or error needs backport to 3.7 labels Jul 13, 2018
serhiy-storchaka
serhiy-storchaka approved these changes Jul 13, 2018
View reviewed changes

@serhiy-storchaka serhiy-storchaka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hide comment

Any chance of adding tests?

@methane

methane commented Jul 13, 2018 via email

Copy link
Copy Markdown
Member Author

vstinner
vstinner approved these changes Jul 13, 2018
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hide comment

LGTM.

I tested manually and confirm that the 3 tests (test_complex test_float test_long) crash without the fix ("out[i+1] = '\0';"), and pass with the fix.

@vstinner

vstinner commented Jul 13, 2018

Copy link
Copy Markdown
Member

You might backport the new tests to 3.6 (it's up to you).

@methane methane merged commit 16dfca4 into python:master Jul 14, 2018
@miss-islington

miss-islington commented Jul 14, 2018

Copy link
Copy Markdown
Contributor

Thanks @methane for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

@methane methane deleted the missing-nul branch July 14, 2018 03:06
@bedevere-bot

bedevere-bot commented Jul 14, 2018

Copy link
Copy Markdown

GH-8279 is a backport of this pull request to the 3.7 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jul 14, 2018
@methane @miss-islington
bpo-34087: Fix buffer overflow in int(s) and similar functions (pytho… …
1d8e712 
…nGH-8274)

`_PyUnicode_TransformDecimalAndSpaceToASCII()` missed trailing NUL char.
It caused buffer overflow in `_Py_string_to_number_with_underscores()`.

This bug is introduced in 9b6c60c.
(cherry picked from commit 16dfca4)

Co-authored-by: INADA Naoki <methane@users.noreply.github.com>
miss-islington added a commit that referenced this pull request Jul 14, 2018
@miss-islington @methane
bpo-34087: Fix buffer overflow in int(s) and similar functions (GH-8274) …
c721472 
`_PyUnicode_TransformDecimalAndSpaceToASCII()` missed trailing NUL char.
It caused buffer overflow in `_Py_string_to_number_with_underscores()`.

This bug is introduced in 9b6c60c.
(cherry picked from commit 16dfca4)

Co-authored-by: INADA Naoki <methane@users.noreply.github.com>
methane added a commit to methane/cpython that referenced this pull request Jul 14, 2018
@methane
bpo-34087: Backport test added by (pythonGH-8274) …
0fb174a 
pythonGH-8276 fixed regression in 3.7.
While the regression is not in 3.6, it's worth to backport
test cases to 3.6 branch too.
methane added a commit that referenced this pull request Jul 14, 2018
@methane
bpo-34087: Backport tests for int/float/complex (GH-8274) …
b2f8aa0 
Cherrypick tests from 16dfca4

While the regression is not in 3.6, it's worth to backport test cases
to 3.6 branch too.
CuriousLearner added a commit to CuriousLearner/cpython that referenced this pull request Jul 14, 2018
@CuriousLearner
Merge branch 'master' into bitwise_docs …
11c1706 
* master: (2633 commits)
  bpo-34087: Fix buffer overflow in int(s) and similar functions (pythonGH-8274)
  bpo-34108: Fix double carriage return in 2to3 on Windows (python#8271)
  bpo-4260: Document that ctypes.xFUNCTYPE are decorators (pythonGH-7924)
  bpo-33723: Fix test_time.test_thread_time() (pythonGH-8267)
  bpo-33967: Remove use of deprecated assertRaisesRegexp() (pythonGH-8261)
  bpo-34080: Fix a memory leak in the compiler. (pythonGH-8222)
  Enable GUI testing on Travis Linux builds via Xvfb (pythonGH-7887)
  bpo-23927: Make getargs.c skipitem() skipping 'w*'. (pythonGH-8192)
  bpo-33648: Remove PY_WARN_ON_C_LOCALE (pythonGH-7114)
  bpo-34092, test_logging: increase SMTPHandlerTest timeout (pythonGH-8245)
  Simplify __all__ in multiprocessing (pythonGH-6856)
  bpo-34083: Update dict order in Functional HOWTO (pythonGH-8230)
  Doc: Point to Simple statements section instead of PEP (pythonGH-8238)
  bpo-29442: Replace optparse with argparse in setup.py (pythonGH-139)
  bpo-33597: Add What's New for PyGC_Head (pythonGH-8236)
  Dataclasses: Fix example on 30.6.8, add method should receive a list rather than an integer. (pythonGH-8038)
  Fix documentation for input and output tutorial (pythonGH-8231)
  bpo-34009: Expand on platform support changes (pythonGH-8022)
  Factor-out two substantially identical code blocks. (pythonGH-8219)
  bpo-34031: fix incorrect usage of self.fail in two tests (pythonGH-8091)
  ...
CuriousLearner added a commit to CuriousLearner/cpython that referenced this pull request Jul 15, 2018
@CuriousLearner
Merge branch 'master' into fix-issue8525 …
fdc3a3d 
* master: (1159 commits)
  bpo-34087: Fix buffer overflow in int(s) and similar functions (pythonGH-8274)
  bpo-34108: Fix double carriage return in 2to3 on Windows (python#8271)
  bpo-4260: Document that ctypes.xFUNCTYPE are decorators (pythonGH-7924)
  bpo-33723: Fix test_time.test_thread_time() (pythonGH-8267)
  bpo-33967: Remove use of deprecated assertRaisesRegexp() (pythonGH-8261)
  bpo-34080: Fix a memory leak in the compiler. (pythonGH-8222)
  Enable GUI testing on Travis Linux builds via Xvfb (pythonGH-7887)
  bpo-23927: Make getargs.c skipitem() skipping 'w*'. (pythonGH-8192)
  bpo-33648: Remove PY_WARN_ON_C_LOCALE (pythonGH-7114)
  bpo-34092, test_logging: increase SMTPHandlerTest timeout (pythonGH-8245)
  Simplify __all__ in multiprocessing (pythonGH-6856)
  bpo-34083: Update dict order in Functional HOWTO (pythonGH-8230)
  Doc: Point to Simple statements section instead of PEP (pythonGH-8238)
  bpo-29442: Replace optparse with argparse in setup.py (pythonGH-139)
  bpo-33597: Add What's New for PyGC_Head (pythonGH-8236)
  Dataclasses: Fix example on 30.6.8, add method should receive a list rather than an integer. (pythonGH-8038)
  Fix documentation for input and output tutorial (pythonGH-8231)
  bpo-34009: Expand on platform support changes (pythonGH-8022)
  Factor-out two substantially identical code blocks. (pythonGH-8219)
  bpo-34031: fix incorrect usage of self.fail in two tests (pythonGH-8091)
  ...
CuriousLearner added a commit to CuriousLearner/cpython that referenced this pull request Jul 21, 2018
@CuriousLearner
Merge branch 'master' of github.com:CuriousLearner/cpython into fix-i… …
7b039a0 
…ssue-33014

* 'master' of github.com:CuriousLearner/cpython: (722 commits)
  bpo-34087: Fix buffer overflow in int(s) and similar functions (pythonGH-8274)
  bpo-34108: Fix double carriage return in 2to3 on Windows (python#8271)
  bpo-4260: Document that ctypes.xFUNCTYPE are decorators (pythonGH-7924)
  bpo-33723: Fix test_time.test_thread_time() (pythonGH-8267)
  bpo-33967: Remove use of deprecated assertRaisesRegexp() (pythonGH-8261)
  bpo-34080: Fix a memory leak in the compiler. (pythonGH-8222)
  Enable GUI testing on Travis Linux builds via Xvfb (pythonGH-7887)
  bpo-23927: Make getargs.c skipitem() skipping 'w*'. (pythonGH-8192)
  bpo-33648: Remove PY_WARN_ON_C_LOCALE (pythonGH-7114)
  bpo-34092, test_logging: increase SMTPHandlerTest timeout (pythonGH-8245)
  Simplify __all__ in multiprocessing (pythonGH-6856)
  bpo-34083: Update dict order in Functional HOWTO (pythonGH-8230)
  Doc: Point to Simple statements section instead of PEP (pythonGH-8238)
  bpo-29442: Replace optparse with argparse in setup.py (pythonGH-139)
  bpo-33597: Add What's New for PyGC_Head (pythonGH-8236)
  Dataclasses: Fix example on 30.6.8, add method should receive a list rather than an integer. (pythonGH-8038)
  Fix documentation for input and output tutorial (pythonGH-8231)
  bpo-34009: Expand on platform support changes (pythonGH-8022)
  Factor-out two substantially identical code blocks. (pythonGH-8219)
  bpo-34031: fix incorrect usage of self.fail in two tests (pythonGH-8091)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@serhiy-storchaka serhiy-storchaka serhiy-storchaka approved these changes

@vstinner vstinner vstinner approved these changes

Assignees

No one assigned

Labels

type-bug An unexpected behavior, bug, or error

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@methane @vstinner @miss-islington @bedevere-bot @serhiy-storchaka @the-knights-who-say-ni