Repository navigation
Conversation
…mesize marshal.c reads stacksize from untrusted data with only a >= 0 check. A stacksize near INT_MAX overflows the co_framesize computation in codeobject.c, producing a negative frame size that corrupts the interpreter's data stack instead of failing cleanly. Reject it in _PyCode_Validate(), the common validation path used by marshal, types.CodeType(), and code.replace().
Member
|
We did not decide whethet to consider the issue. Please do not open PRs for those cases. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes gh-158648.
Python/marshal.c reads stacksize from untrusted marshal data with only a >= 0 check. When the code object is constructed, co_framesize = nlocalsplus + stacksize + FRAME_SPECIALS_SIZE is computed as a C int; a stacksize near INT_MAX overflows this, producing a negative co_framesize. That value defeats the stack-space check in _PyThreadState_HasStackSpace _PyThreadState_PushFrame and can move the interpreter's data-stack pointer backwards, corrupting memory rather than failing cleanly.
This adds a bounds check to _PyCode_Validate() — the single validation path shared by marshal, types.CodeType(), and code.replace() — that rejects a stacksize large enough to overflow co_framesize, raising OverflowError instead.
Verified against the PoC in the issue (now raises OverflowError instead of corrupting frame state), plus full test_marshal, test_code, test_sys_settrace, and test_frame runs (all passing).