Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[3.8] gh-95778: CVE-2020-10735: Prevent DoS by very large int() #96503

Merged
merged 17 commits into from Sep 5, 2022

Commits on Aug 24, 2022

  1. Backport to 3.8 of psrt/CVE-2020-10735-3.10backport.

    Co-authored-by: Gregory P. Smith <greg@krypto.org>
    2 people authored and tiran committed Aug 24, 2022
    Configuration menu
    Copy the full SHA
    b518238 View commit details
    Browse the repository at this point in the history

Commits on Aug 30, 2022

  1. Configuration menu
    Copy the full SHA
    504e82f View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    cae5eba View commit details
    Browse the repository at this point in the history
  3. Backport the Parser/pegen.c change for a good SyntaxError to ast.c.

    Fixes test_ast and test_compile.
    gpshead committed Aug 30, 2022
    Configuration menu
    Copy the full SHA
    cd54fc3 View commit details
    Browse the repository at this point in the history
  4. Add Whats New entry.

    gpshead committed Aug 30, 2022
    Configuration menu
    Copy the full SHA
    eb68f9c View commit details
    Browse the repository at this point in the history

Commits on Sep 1, 2022

  1. Configuration menu
    Copy the full SHA
    75bbbbf View commit details
    Browse the repository at this point in the history
  2. Move the whatsnew text per review.

    Ned pointed this out on the 3.7 branch, it matches other patch changes
    and stands out better.
    gpshead committed Sep 1, 2022
    Configuration menu
    Copy the full SHA
    14467fc View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    1e39232 View commit details
    Browse the repository at this point in the history
  4. Configuration menu
    Copy the full SHA
    70b9aef View commit details
    Browse the repository at this point in the history

Commits on Sep 2, 2022

  1. Fix the docs build.

    gpshead committed Sep 2, 2022
    Configuration menu
    Copy the full SHA
    7eb255f View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    0504ecb View commit details
    Browse the repository at this point in the history
  3. hexadecimal spelling =)

    gpshead committed Sep 2, 2022
    Configuration menu
    Copy the full SHA
    8acc891 View commit details
    Browse the repository at this point in the history

Commits on Sep 4, 2022

  1. doc typo: limitation

    gpshead committed Sep 4, 2022
    Configuration menu
    Copy the full SHA
    52f2c26 View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    510349b View commit details
    Browse the repository at this point in the history
  3. remove unneeded doc note on float.as_integer_ratio

    Per mdickinson@'s comment on the main branch PR.
    gpshead committed Sep 4, 2022
    Configuration menu
    Copy the full SHA
    ac99726 View commit details
    Browse the repository at this point in the history
  4. pythongh-95778: Correctly pre-check for int-to-str conversion (python…

    …#96537)
    
    Converting a large enough `int` to a decimal string raises `ValueError` as expected. However, the raise comes _after_ the quadratic-time base-conversion algorithm has run to completion. For effective DOS prevention, we need some kind of check before entering the quadratic-time loop. Oops! =)
    
    The quick fix: essentially we catch _most_ values that exceed the threshold up front. Those that slip through will still be on the small side (read: sufficiently fast), and will get caught by the existing check so that the limit remains exact.
    
    The justification for the current check. The C code check is:
    ```c
    max_str_digits / (3 * PyLong_SHIFT) <= (size_a - 11) / 10
    ```
    
    In GitHub markdown math-speak, writing $M$ for `max_str_digits`, $L$ for `PyLong_SHIFT` and $s$ for `size_a`, that check is:
    $$\left\lfloor\frac{M}{3L}\right\rfloor \le \left\lfloor\frac{s - 11}{10}\right\rfloor$$
    
    From this it follows that
    $$\frac{M}{3L} < \frac{s-1}{10}$$
    hence that
    $$\frac{L(s-1)}{M} > \frac{10}{3} > \log_2(10).$$
    So
    $$2^{L(s-1)} > 10^M.$$
    But our input integer $a$ satisfies $|a| \ge 2^{L(s-1)}$, so $|a|$ is larger than $10^M$. This shows that we don't accidentally capture anything _below_ the intended limit in the check.
    
    <!-- gh-issue-number: pythongh-95778 -->
    * Issue: pythongh-95778
    <!-- /gh-issue-number -->
    
    Co-authored-by: Gregory P. Smith [Google LLC] <greg@krypto.org>
    mdickinson and gpshead committed Sep 4, 2022
    Configuration menu
    Copy the full SHA
    17bd053 View commit details
    Browse the repository at this point in the history
  5. Configuration menu
    Copy the full SHA
    c9212d5 View commit details
    Browse the repository at this point in the history