Skip to content

Possible overflow in typeobject.c:tail_contains #126862

Closed
@federicovalenso

Description

@federicovalenso

Bug report

Bug description:

whence+1 could lead to overflow for large value of whence. I think changing type from int to Py_ssize_t could fix the problem (remain is input parameter):

static int
pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size)
{
...
    remain = PyMem_New(Py_ssize_t, to_merge_size);

CPython versions tested on:

3.11

Operating systems tested on:

Linux

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.12only security fixes3.13bugs and security fixes3.14bugs and security fixesinterpreter-core(Objects, Python, Grammar, and Parser dirs)type-bugAn unexpected behavior, bug, or error

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions