Skip to content

gh-125010: Fix use-after-free in AST repr() #125015

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JelleZijlstra merged 7 commits into from
Oct 6, 2024
Merged

gh-125010: Fix use-after-free in AST repr() #125015

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
554507d
Fix use-after-free in AST repr()
tomasr8 Oct 5, 2024
c83821f
Add news entry
tomasr8 Oct 5, 2024
32efba7
Add tests
tomasr8 Oct 6, 2024
49a405d
Add a clarification to the test
tomasr8 Oct 6, 2024
a447511
Simplify test
tomasr8 Oct 6, 2024
3dd380c
Simplify decref logic
tomasr8 Oct 6, 2024
12b3098
Remove news entry
tomasr8 Oct 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Simplify test
  • Loading branch information
@tomasr8
tomasr8 committed Oct 6, 2024
commit a44751144ef4debeab39a96607a38ff6b041fe4f
18 changes: 7 additions & 11 deletions Lib/test/test_ast/test_ast.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -789,6 +789,13 @@ def test_repr(self) -> None:
with self.subTest(test_input=test):
self.assertEqual(repr(ast.parse(test)), snapshot)

def test_repr_large_input_crash(self):
# gh-125010: Fix use-after-free in ast repr()
source = "0x0" + "e" * 10_000
with self.assertRaisesRegex(ValueError,
r"Exceeds the limit \(\d+ digits\)"):
repr(ast.Constant(value=eval(source)))


class CopyTests(unittest.TestCase):
"""Test copying and pickling AST nodes."""
Expand Down Expand Up @@ -1614,17 +1621,6 @@ def test_literal_eval_syntax_errors(self):
(\
\ ''')

def test_literal_eval_large_input_crash(self):
# gh-125010: Fix use-after-free in ast repr()
# Note: Without setting sys.set_int_max_str_digits(0),
# this code throws a 'ValueError: Exceeds the limit (4300 digits)'.
# With sys.set_int_max_str_digits(0),
# this code throws a 'ValueError: malformed node or string on line 1':
source = "{0x0" + "e" * 250_000 + "%" + "e" * 250_000 + "1j}"
with self.assertRaisesRegex(ValueError,
r"Exceeds the limit \(4300 digits\)"):
ast.literal_eval(source)

def test_bad_integer(self):
# issue13436: Bad error message with invalid numeric values
body = [ast.ImportFrom(module='time',
Expand Down