https://github.com/python/cpython/commit/2fcdc8488c32d18f4567f797094068a994777f16
commit: 2fcdc8488c32d18f4567f797094068a994777f16
branch: main
author: Bénédikt Tran <[email protected]>
committer: JelleZijlstra <[email protected]>
date: 2025-01-10T03:32:53Z
summary:
gh-126862: Use `Py_ssize_t` instead of `int` when processing the number of
super-classes (#127523)
files:
A
Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst
M Objects/typeobject.c
diff --git
a/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst
b/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst
new file mode 100644
index 00000000000000..d930c2963e3632
--- /dev/null
+++
b/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst
@@ -0,0 +1,2 @@
+Fix a possible overflow when a class inherits from an absurd number of
+super-classes. Reported by Valery Fedorenko. Patch by Bénédikt Tran.
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 7f95b519561e68..680846f1c0b865 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2860,7 +2860,7 @@ vectorcall_maybe(PyThreadState *tstate, PyObject *name,
*/
static int
-tail_contains(PyObject *tuple, int whence, PyObject *o)
+tail_contains(PyObject *tuple, Py_ssize_t whence, PyObject *o)
{
Py_ssize_t j, size;
size = PyTuple_GET_SIZE(tuple);
@@ -2923,7 +2923,7 @@ check_duplicates(PyObject *tuple)
*/
static void
-set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, int *remain)
+set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, Py_ssize_t
*remain)
{
Py_ssize_t i, n, off;
char buf[1000];
@@ -2978,13 +2978,13 @@ pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t
to_merge_size)
{
int res = 0;
Py_ssize_t i, j, empty_cnt;
- int *remain;
+ Py_ssize_t *remain;
/* remain stores an index into each sublist of to_merge.
remain[i] is the index of the next base in to_merge[i]
that is not included in acc.
*/
- remain = PyMem_New(int, to_merge_size);
+ remain = PyMem_New(Py_ssize_t, to_merge_size);
if (remain == NULL) {
PyErr_NoMemory();
return -1;
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3/lists/python-checkins.python.org/
Member address: [email protected]
