GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.11] gh-95778: CVE-2020-10735: Prevent DoS by very large int() by gpshead · Pull Request #96500 · python/cpython

Conversation

@gpshead

@gpshead gpshead commented Sep 2, 2022 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Integer to and from text conversions via CPython's bignum int type is not safe against denial of service attacks due to malicious input. Very large input strings with hundred thousands of digits can consume several CPU seconds.

This PR comes fresh from a pile of work done in our private PSRT security response team repo.

This backports #96499 aka 511ca94

Signed-off-by: Christian Heimes [Red Hat] [email protected]
Tons-of-polishing-up-by: Gregory P. Smith [Google] [email protected]
Reviews via the private PSRT repo via many others (see the NEWS entry in the PR).

  • Issue: CVE-2020-10735: Prevent DoS by large int<->str conversions #95778

I wrote up a one pager for the release managers.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
gpshead and others added 8 commits September 1, 2022 09:40
@gpshead @tiran
Backport to 3.11 from psrt/CVE-2020-10735@ee533c68.
80dba63
@gpshead @tiran
Add the whatsnew entry.
b9f4e89
@gpshead @tiran
Update attribution in Misc/NEWS.d
58a4f64
Co-authored-by: Christian Heimes <[email protected]>
@tiran
Move int_max_str_digits out of PyInterpreterState
9e1f13d
Abigail does not like the fact that `PyInterpreterState` has changed
size and some fields have been moved around. Even placing
`int_max_str_digits` after `_initial_thread` does not make her happy.

Let's move the field out ouf the state and make the setting a
process-wide global. It's ugly, but better ugly than breaking somebody's
code.

```
  [C]'function void PyEval_AcquireThread(PyThreadState*)' at ceval.c:452:1 has some indirect sub-type changes:
    parameter 1 of type 'PyThreadState*' has sub-type changes:
      in pointed to type 'typedef PyThreadState' at pytypedefs.h:24:1:
        underlying type 'struct _ts' at pystate.h:82:1 changed:
          type size hasn't changed
          1 data member changes (2 filtered):
           type of 'PyInterpreterState* _ts::interp' changed:
             in pointed to type 'typedef PyInterpreterState' at pytypedefs.h:25:1:
               underlying type 'struct _is' at pycore_interp.h:78:1 changed:
                 type size changed from 861952 to 862016 (in bits)
                 1 data member insertion:
                   'int _is::int_max_str_digits', at offset 859072 (in bits) at pycore_interp.h:179:1
                 2 data member changes (3 filtered):
                  type of 'pyruntimestate* _is::runtime' changed:
                    in pointed to type 'struct pyruntimestate' at pycore_runtime.h:59:1:
                      type size changed from 1333440 to 1333504 (in bits)
                      1 data member changes (2 filtered):

                  'PyThreadState _is::_initial_thread' offset changed from 859072 to 859136 (in bits) (by +64 bits)
```
@tiran
Revert "Move int_max_str_digits out of PyInterpreterState"
4647594
This reverts commit 9e1f13d.
@tiran
Manually add new field to abi file
53e12ec
@gpshead
Make the doctest actually run & fix it.
90e020b
@gpshead
Fix the docs build.
d6d668a
@gpshead gpshead self-assigned this Sep 2, 2022
@bedevere-bot bedevere-bot added the awaiting core review label Sep 2, 2022
@gpshead gpshead assigned pablogsal Sep 2, 2022
gpshead added 2 commits September 1, 2022 21:33
@gpshead
Merge branch '3.11' into CVE-2020-10735-3.11backport
dfe1922
@gpshead
Rename the news file to appease the Bedevere bot.
282052f
@gpshead gpshead added the release-blocker label Sep 2, 2022
@tiran tiran added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Sep 2, 2022
@bedevere-bot

bedevere-bot commented Sep 2, 2022

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @tiran for commit 282052f 🤖

If you want to schedule another build, you need to add the ":hammer: test-with-buildbots" label again.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Sep 2, 2022
@gpshead
gpshead marked this pull request as ready for review September 2, 2022 05:56
@gpshead
gpshead requested review from lysnikolaou, pablogsal, rhettinger and terryjreedy as code owners September 2, 2022 05:56
njsmith
njsmith reviewed Sep 2, 2022
View reviewed changes
Comment thread Doc/library/stdtypes.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

@gpshead
hexadecimal spelling =)
c4aea14
@gpshead
gpshead merged commit f8b71da into python:3.11 Sep 2, 2022
@bedevere-bot bedevere-bot removed the awaiting core review label Sep 2, 2022
@gpshead

gpshead commented Sep 4, 2022

Copy link
Copy Markdown
Member Author

bugfix incoming #96537

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@CAM-Gerlach CAM-Gerlach mentioned this pull request Oct 16, 2022
gh-95913: Forward-port int/str security change to 3.11 What's New in main #98344
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@terryjreedy terryjreedy Awaiting requested review from terryjreedy terryjreedy is a code owner
@rhettinger rhettinger Awaiting requested review from rhettinger rhettinger is a code owner
@pablogsal pablogsal Awaiting requested review from pablogsal pablogsal is a code owner
@lysnikolaou lysnikolaou Awaiting requested review from lysnikolaou lysnikolaou is a code owner
1 more reviewer
@njsmith njsmith njsmith left review comments
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

@pablogsal pablogsal

Labels

release-blocker

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

@gpshead @bedevere-bot @njsmith @tiran @pablogsal
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.