integer overflow in string translate

[pkt]

BPO	23362
Nosy	@benjaminp, @serhiy-storchaka
Files	poc_translate.py

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/benjaminp'
closed_at = <Date 2015-03-02.18:24:37.761>
created_at = <Date 2015-02-01.13:53:20.936>
labels = ['type-crash']
title = 'integer overflow in string translate'
updated_at = <Date 2015-03-03.05:10:21.172>
user = 'https://bugs.python.org/pkt'

bugs.python.org fields:

activity = <Date 2015-03-03.05:10:21.172>
actor = 'Arfrever'
assignee = 'benjamin.peterson'
closed = True
closed_date = <Date 2015-03-02.18:24:37.761>
closer = 'python-dev'
components = []
creation = <Date 2015-02-01.13:53:20.936>
creator = 'pkt'
dependencies = []
files = ['37961']
hgrepos = []
issue_num = 23362
keywords = []
message_count = 3.0
messages = ['235169', '235185', '237070']
nosy_count = 5.0
nosy_names = ['benjamin.peterson', 'Arfrever', 'python-dev', 'serhiy.storchaka', 'pkt']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue23362'
versions = ['Python 3.3', 'Python 3.4', 'Python 3.5']

[pkt]

# Bug
# ---
#
# PyObject *
# _PyUnicode_TranslateCharmap(PyObject *input,
# PyObject *mapping,
# const char *errors)
# {
# ...
# size = PyUnicode_GET_LENGTH(input);
# ...
# osize = size;
# 1 output = PyMem_Malloc(osize * sizeof(Py_UCS4));
#
# 1. Input size = 2^30, so osize*sizeof(Py_UCS4)=2^32==0 (modulo 2^32) and malloc
# allocates a 0 byte buffer
#
# Crash
# -----
#
# Breakpoint 2, _PyUnicode_TranslateCharmap (
# input='aa...', mapping={97: 'b'}, errors=0x828c82b "ignore") at Objects/unicodeobject.c:8597
\bpo-8597 {
# ...
\bpo-8636 output = PyMem_Malloc(osize * sizeof(Py_UCS4));
# (gdb) print osize
# $1 = 1073741824
# (gdb) print osize*4
# $2 = 0
# (gdb) c
# Continuing.
#
# Program received signal SIGSEGV, Segmentation fault.
# 0x0814aed2 in charmaptranslate_output (
# input='aa...', ipos=51302, mapping={97: 'b'}, output=0xbfc40860, osize=0xbfc40864, opos=0xbfc40868,
# res=0xbfc40874) at Objects/unicodeobject.c:8574
\bpo-8574 (*output)[(*opos)++] = PyUnicode_READ_CHAR(*res, 0);
#
# OS info
# -------

# 
# % ./python -V
# Python 3.4.1
#  
# % uname -a
# Linux ubuntu 3.8.0-29-generic #42~precise1-Ubuntu SMP Wed Aug 14 15:31:16 UTC 2013 i686 i686 i386 GNU/Linux
#  
 
s="a"*(2**30)
s.translate({ord('a'): 'b'})

[serhiy-storchaka]

Do you want to provide a patch?

[python-dev]

New changeset 21cd7f83e0aa by Benjamin Peterson in branch '3.3':
use PyMem_NEW to detect overflow (closes bpo-23362)
https://hg.python.org/cpython/rev/21cd7f83e0aa

New changeset 880906bbf792 by Benjamin Peterson in branch '3.4':
merge 3.3 (bpo-23362)
https://hg.python.org/cpython/rev/880906bbf792