Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gh-95778: Mention sys.set_int_max_str_digits() in error message #96874

Merged
merged 3 commits into from Sep 16, 2022
Merged

gh-95778: Mention sys.set_int_max_str_digits() in error message #96874

merged 3 commits into from Sep 16, 2022

Conversation

vstinner
Copy link
Member

@vstinner vstinner commented Sep 16, 2022

When ValueError is raised if an integer is larger than the limit, mention sys.set_int_max_str_digits() in the error message.

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.
Copy link
Member

@gpshead gpshead left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you update the error message in the docs >>> examples to match?

A news entry given this'll be backported seems like a good idea.

Overall: Thanks, this seems like a good idea. Including backporting it as far as possible so that future security releases pick it up.

@bedevere-bot
Copy link

When you're done making the requested changes, leave the comment: I have made the requested changes; please review again.

@gpshead gpshead added needs backport to 3.7 needs backport to 3.8 only security fixes needs backport to 3.9 only security fixes needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Sep 16, 2022
@vstinner
Copy link
Member Author

In Python 3.11 and 3.12, maybe Exception.__notes__ would be useful for that. But since you want to backport this change to Python 3.10 and older, I prefer to write a separated PR to add a note on Python 3.11 and 3.12.

@vstinner vstinner merged commit e841ffc into python:main Sep 16, 2022
@miss-islington
Copy link
Contributor

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7, 3.8, 3.9, 3.10, 3.11.
🐍🍒⛏🤖

@vstinner vstinner deleted the maxdigits_msg branch September 16, 2022 18:04
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 16, 2022
…pythonGH-96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.
(cherry picked from commit e841ffc)

Co-authored-by: Victor Stinner <vstinner@python.org>
@bedevere-bot bedevere-bot removed the needs backport to 3.11 only security fixes label Sep 16, 2022
@bedevere-bot
Copy link

GH-96875 is a backport of this pull request to the 3.11 branch.

@miss-islington
Copy link
Contributor

Sorry, @vstinner, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker e841ffc915e82e5ea6e3b473205417d63494808d 3.9

@bedevere-bot
Copy link

GH-96876 is a backport of this pull request to the 3.10 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 16, 2022
…pythonGH-96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.
(cherry picked from commit e841ffc)

Co-authored-by: Victor Stinner <vstinner@python.org>
@bedevere-bot bedevere-bot removed the needs backport to 3.10 only security fixes label Sep 16, 2022
@miss-islington
Copy link
Contributor

Sorry @vstinner, I had trouble checking out the 3.8 backport branch.
Please backport using cherry_picker on command line.
cherry_picker e841ffc915e82e5ea6e3b473205417d63494808d 3.8

@miss-islington
Copy link
Contributor

Sorry, @vstinner, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker e841ffc915e82e5ea6e3b473205417d63494808d 3.7

@vstinner vstinner added needs backport to 3.9 only security fixes and removed needs backport to 3.9 only security fixes labels Sep 16, 2022
@miss-islington
Copy link
Contributor

Thanks @vstinner for the PR 🌮🎉.. I'm working now to backport this PR to: 3.9.
🐍🍒⛏🤖

@miss-islington
Copy link
Contributor

Sorry @vstinner, I had trouble checking out the 3.9 backport branch.
Please backport using cherry_picker on command line.
cherry_picker e841ffc915e82e5ea6e3b473205417d63494808d 3.9

@bedevere-bot bedevere-bot removed the needs backport to 3.9 only security fixes label Sep 16, 2022
@bedevere-bot
Copy link

GH-96877 is a backport of this pull request to the 3.9 branch.

@vstinner
Copy link
Member Author

@gpshead: Do you think that we should bother security-only branches (3.7, 3.8 and 3.9) with this minor enhancement? I created PR #96877 manually for 3.9. I'm not sure why but the bot failed to backport whereas it worked automatically locally (git cherry-pick -x). Maybe it makes sense if we also fix the minor issue #96848 in these branches.

miss-islington added a commit that referenced this pull request Sep 16, 2022
…6874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.
(cherry picked from commit e841ffc)

Co-authored-by: Victor Stinner <vstinner@python.org>
@gpshead
Copy link
Member

gpshead commented Sep 16, 2022

I'd backport both this and even the #96848 fix to those branches for consistency and user friendliness.

miss-islington added a commit that referenced this pull request Sep 16, 2022
…6874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.
(cherry picked from commit e841ffc)

Co-authored-by: Victor Stinner <vstinner@python.org>
ambv pushed a commit that referenced this pull request Oct 4, 2022
…#96874) (#96877)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

Co-authored-by: Ned Deily <nad@python.org>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 4, 2022
…essage (pythonGH-96874) (pythonGH-96877)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

Co-authored-by: Ned Deily <nad@python.org>
(cherry picked from commit 4118813)

Co-authored-by: Victor Stinner <vstinner@python.org>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 4, 2022
…essage (pythonGH-96874) (pythonGH-96877)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

Co-authored-by: Ned Deily <nad@python.org>
(cherry picked from commit 4118813)

Co-authored-by: Victor Stinner <vstinner@python.org>
ambv pushed a commit that referenced this pull request Oct 4, 2022
…GH-96874) (GH-96877) (GH-97835)

[3.9] gh-95778: Mention sys.set_int_max_str_digits() in error message (GH-96874) (GH-96877)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

Co-authored-by: Ned Deily <nad@python.org>
(cherry picked from commit 4118813)

Co-authored-by: Victor Stinner <vstinner@python.org>
ambv pushed a commit that referenced this pull request Oct 4, 2022
…GH-96874) (GH-96877) (GH-97836)

[3.9] gh-95778: Mention sys.set_int_max_str_digits() in error message (GH-96874) (GH-96877)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

Co-authored-by: Ned Deily <nad@python.org>
(cherry picked from commit 4118813)

Co-authored-by: Victor Stinner <vstinner@python.org>
pablogsal pushed a commit that referenced this pull request Oct 24, 2022
…6874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.
(cherry picked from commit e841ffc)

Co-authored-by: Victor Stinner <vstinner@python.org>
stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 11, 2024
pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)
stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 11, 2024
pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)
stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 20, 2024
pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)
stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 20, 2024
pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)
stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 20, 2024
pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)
stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 20, 2024
pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)
stratakis pushed a commit to stratakis/cpython that referenced this pull request Mar 25, 2024
pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Mar 26, 2024
pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)
mcepl pushed a commit to openSUSE-Python/cpython that referenced this pull request Apr 2, 2024
pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs backport to 3.8 only security fixes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants