https://github.com/python/cpython/commit/37e9d846ff55c20f5751af039f5151481e5c7e8e
commit: 37e9d846ff55c20f5751af039f5151481e5c7e8e
branch: 3.13
author: Stan Ulbrych <[email protected]>
committer: serhiy-storchaka <[email protected]>
date: 2026-03-10T17:44:10Z
summary:
[3.13] Fix integer overflow for formats "s" and "p" in the struct module
(GH-145750) (GH-145777)
(cherry picked from commit 4d0dce0c8ddc4d0321bd590a1a33990edc2e1b08)
files:
A Misc/NEWS.d/next/Library/2026-03-10-14-13-12.gh-issue-145750.iQsTeX.rst
M Lib/test/test_struct.py
M Modules/_struct.c
diff --git a/Lib/test/test_struct.py b/Lib/test/test_struct.py
index 0105027403ae19..0aa71d20db89e4 100644
--- a/Lib/test/test_struct.py
+++ b/Lib/test/test_struct.py
@@ -550,6 +550,12 @@ def test_count_overflow(self):
hugecount3 = '{}i{}q'.format(sys.maxsize // 4, sys.maxsize // 8)
self.assertRaises(struct.error, struct.calcsize, hugecount3)
+ hugecount4 = '{}?s'.format(sys.maxsize)
+ self.assertRaises(struct.error, struct.calcsize, hugecount4)
+
+ hugecount5 = '{}?p'.format(sys.maxsize)
+ self.assertRaises(struct.error, struct.calcsize, hugecount5)
+
def test_trailing_counter(self):
store = array.array('b', b' '*100)
diff --git
a/Misc/NEWS.d/next/Library/2026-03-10-14-13-12.gh-issue-145750.iQsTeX.rst
b/Misc/NEWS.d/next/Library/2026-03-10-14-13-12.gh-issue-145750.iQsTeX.rst
new file mode 100644
index 00000000000000..a909bea2caffe9
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-03-10-14-13-12.gh-issue-145750.iQsTeX.rst
@@ -0,0 +1,3 @@
+Avoid undefined behaviour from signed integer overflow when parsing format
+strings in the :mod:`struct` module. Found by OSS Fuzz in
+:oss-fuzz:`488466741`.
diff --git a/Modules/_struct.c b/Modules/_struct.c
index 93b913955538b6..4c84950af344b8 100644
--- a/Modules/_struct.c
+++ b/Modules/_struct.c
@@ -1476,7 +1476,13 @@ prepare_s(PyStructObject *self, PyObject *format)
switch (c) {
case 's': /* fall through */
- case 'p': len++; ncodes++; break;
+ case 'p':
+ if (len == PY_SSIZE_T_MAX) {
+ goto overflow;
+ }
+ len++;
+ ncodes++;
+ break;
case 'x': break;
default:
if (num > PY_SSIZE_T_MAX - len) {
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
