Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity
cpython/Python
History
Gregory P. Smith 511ca94520
gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96499) 
Integer to and from text conversions via CPython's bignum `int` type is not safe against denial of service attacks due to malicious input. Very large input strings with hundred thousands of digits can consume several CPU seconds.

This PR comes fresh from a pile of work done in our private PSRT security response team repo.

Signed-off-by: Christian Heimes [Red Hat] <christian@python.org>
Tons-of-polishing-up-by: Gregory P. Smith [Google] <greg@krypto.org>
Reviews via the private PSRT repo via many others (see the NEWS entry in the PR).

<!-- gh-issue-number: gh-95778 -->
* Issue: gh-95778
<!-- /gh-issue-number -->

I wrote up [a one pager for the release managers](https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y/edit#). Much of that text wound up in the Issue. Backports PRs already exist. See the issue for links.
 		2022-09-02 09:35:08 -07:00
..
clinic gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96499) 2022-09-02 09:35:08 -07:00
deepfreeze bpo-45696: Deep-freeze selected modules (GH-29118) 2021-11-10 18:01:53 -08:00
frozen_modules bpo-45020: Drop the frozen .h files from the repo. (gh-28392) 2021-09-16 14:20:52 -06:00
Python-ast.c gh-95185: Check recursion depth in the AST constructor (#95186) 2022-07-24 15:58:52 +01:00
Python-tokenize.c gh-90928: Statically Initialize the Keywords Tuple in Clinic-Generated Code (gh-95860) 2022-08-11 15:25:49 -06:00
README Issue #18093: Factor out the programs that embed the runtime 2014-07-25 21:52:14 +10:00
_warnings.c gh-91102: Port 8-argument _warnings.warn_explicit to Argument Clinic (#92891) 2022-07-20 22:24:51 +02:00
adaptive.md Update adaptive.md for inline caching (GH-31817) 2022-03-11 14:29:10 +00:00
asdl.c bpo-43244: Remove ast.h, asdl.h, Python-ast.h headers (GH-24933) 2021-03-23 20:47:40 +01:00
ast.c gh-92597: Improve error message for AST nodes with invalid ranges (GH-93398) 2022-06-01 13:51:17 +01:00
ast_opt.c bpo-45995: add "z" format specifer to coerce negative 0 to zero (GH-30049) 2022-04-11 15:34:18 +01:00
ast_unparse.c bpo-43224: Implement PEP 646 grammar changes (GH-31018) 2022-03-26 09:55:35 -07:00
bltinmodule.c GH-90230: Add stats to breakdown the origin of calls to `PyEval_EvalFrame` (GH-93284) 2022-05-27 16:31:41 +01:00
bootstrap_hash.c bpo-46303: Move fileutils.h private functions to internal C API (GH-30484) 2022-01-11 11:56:16 +01:00
ceval.c gh-93554: Conditional jump opcodes only jump forward (GH-96318) 2022-09-01 21:36:47 +01:00
ceval_gil.c GH-96177: Move GIL and eval breaker code out of ceval.c into ceval_gil.c. (GH-96204) 2022-08-24 14:21:01 +01:00
codecs.c bpo-46541: Replace core use of _Py_IDENTIFIER() with statically initialized global objects. (gh-30928) 2022-02-08 13:39:07 -07:00
compile.c gh-93554: Conditional jump opcodes only jump forward (GH-96318) 2022-09-01 21:36:47 +01:00
condvar.h gh-74953: _PyThread_cond_after() uses _PyTime_t (#94056) 2022-06-21 15:45:49 +02:00
context.c Add more stats for freelist use and allocations. (GH-92211) 2022-05-03 16:40:24 -06:00
dtoa.c bpo-45412: Add _PY_SHORT_FLOAT_REPR macro (GH-31171) 2022-02-23 18:16:23 +01:00
dup2.c gh-95174: Handle missing dup() and constants in WASI (GH-95229) 2022-07-26 11:16:51 +02:00
dynamic_annotations.c bpo-32241: Add the const qualifire to declarations of umodifiable strings. (#4748) 2017-12-12 13:55:04 +02:00
dynload_hpux.c bpo-44959: Add fallback to extension modules with '.sl' suffix on HP-UX (GH-27857) 2021-09-08 14:43:00 +02:00
dynload_shlib.c bpo-43895: Remove an unnecessary cache of shared object handles (GH-25487) 2021-07-07 16:26:06 -07:00
dynload_stub.c
…
dynload_win.c gh-92536: PEP 623: Remove wstr and legacy APIs from Unicode (GH-92537) 2022-05-12 14:48:38 +09:00
emscripten_signal.c bpo-47176: Interrupt handling for wasm32-emscripten builds without pthreads (GH-32209) 2022-04-03 22:58:52 +02:00
errors.c gh-94673: Add _PyStaticType_InitBuiltin() (#95152) 2022-07-25 12:47:31 -06:00
fileutils.c gh-95174: Handle missing dup() and constants in WASI (GH-95229) 2022-07-26 11:16:51 +02:00
formatter_unicode.c gh-89653: Use int type for Unicode kind (#92704) 2022-05-13 12:41:05 +02:00
frame.c GH-96237: Allow non-functions as reference-holder in frames. (GH-96238) 2022-08-25 10:16:55 +01:00
frozen.c bpo-46748: Don't import <stdbool.h> in public headers (GH-31553) 2022-02-25 09:25:54 +01:00
frozenmain.c gh-93103: Parser uses PyConfig.parser_debug instead of Py_DebugFlag (#93106) 2022-05-24 22:35:08 +02:00
future.c bpo-38605: Revert making 'from __future__ import annotations' the default (GH-25490) 2021-04-21 12:41:19 +01:00
getargs.c GH-95909: Make `_PyArg_Parser` initialization thread safe (GH-95958) 2022-08-16 11:22:14 -07:00
getcompiler.c closes bpo-43278: remove unnecessary leading '\n' from COMPILER when build with GCC/Clang (GH-24606) 2021-02-25 20:24:21 -08:00
getcopyright.c Update copyright year to 2022. (GH-30335) 2022-01-02 12:08:48 -08:00
getopt.c gh-90300: split --help output into separate options (#30331) 2022-06-01 05:50:01 -04:00
getplatform.c bpo-32150: Expand tabs to spaces in C files. (#4583) 2017-11-28 17:56:10 +02:00
getversion.c bpo-43931: Export Python version as API data (GH-25577) 2021-12-09 17:52:05 -08:00
hamt.c GH-93207: Remove HAVE_STDARG_PROTOTYPES configure check for stdarg.h (#93215) 2022-05-27 13:30:45 +02:00
hashtable.c bpo-41061: Fix incorrect expressions in hashtable (GH-21028) 2020-06-22 00:41:48 -07:00
import.c gh-93741: Add private C API _PyImport_GetModuleAttrString() (GH-93742) 2022-06-14 07:15:26 +03:00
importdl.c bpo-47162: Add call trampoline to mitigate bad fpcasts on Emscripten (GH-32189) 2022-03-30 12:28:33 -07:00
importdl.h bpo-47162: Add call trampoline to mitigate bad fpcasts on Emscripten (GH-32189) 2022-03-30 12:28:33 -07:00
initconfig.c gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96499) 2022-09-02 09:35:08 -07:00
makeopcodetargets.py gh-94216: add pseudo instructions to the dis/opcodes modules (GH-94241) 2022-07-01 15:33:35 +01:00
marshal.c gh-78214: marshal: Stabilize FLAG_REF usage (GH-8226) 2022-05-04 10:01:15 +09:00
modsupport.c bpo-1635741: Add PyModule_AddObjectRef() function (GH-23122) 2020-11-04 13:59:15 +01:00
mysnprintf.c bpo-36020: Require vsnprintf() to build Python (GH-20899) 2020-06-16 00:54:44 +02:00
mystrtoul.c bpo-35134: Add Include/cpython/longobject.h (GH-29044) 2021-10-19 02:04:52 +02:00
opcode_targets.h gh-93554: Conditional jump opcodes only jump forward (GH-96318) 2022-09-01 21:36:47 +01:00
pathconfig.c gh-91985: Ensure in-tree builds override platstdlib_dir in every path calculation (GH-93641) 2022-06-16 22:41:57 +01:00
preconfig.c gh-77782: Deprecate global configuration variable (#93943) 2022-06-17 16:12:00 +02:00
pyarena.c bpo-43244: Remove the pyarena.h header (GH-25007) 2021-03-24 02:23:01 +01:00
pyctype.c
…
pyfpe.c bpo-46315: Add ifdef HAVE_ feature checks for WASI compatibility (GH-30507) 2022-01-13 09:46:04 +01:00
pyhash.c bpo-29410: Change the default hash algorithm to SipHash13. (GH-28752) 2021-10-10 17:29:46 +09:00
pylifecycle.c gh-96143: Allow Linux perf profiler to see Python calls (GH-96123) 2022-08-30 10:11:18 -07:00
pymath.c bpo-45440: Remove pymath.c fallbacks (GH-28977) 2021-10-15 19:45:34 +02:00
pystate.c GH-96071: fix deadlock in PyGILState_Ensure (GH-96124) 2022-08-19 12:43:00 -07:00
pystrcmp.c bpo-41524: fix pointer bug in PyOS_mystr{n}icmp (GH-21845) 2020-08-27 14:45:25 +09:00
pystrhex.c gh-91768: C API no longer use "const PyObject*" type (#91769) 2022-04-21 22:07:19 +02:00
pystrtod.c bpo-45995: add "z" format specifer to coerce negative 0 to zero (GH-30049) 2022-04-11 15:34:18 +01:00
pythonrun.c gh-92651: Remove the Include/token.h header file (#92652) 2022-05-11 23:22:50 +02:00
pytime.c gh-74953: Add _PyTime_FromMicrosecondsClamp() function (#93942) 2022-06-17 16:11:13 +02:00
specialize.c gh-93554: Conditional jump opcodes only jump forward (GH-96318) 2022-09-01 21:36:47 +01:00
stdlib_module_names.h gh-93243: Make smtpd private before porting its users (GH-93246) 2022-08-05 17:41:29 -07:00
structmember.c bpo-44655: Include the name of the type in unset __slots__ attribute errors (GH-27199) 2021-07-17 00:34:46 +01:00
suggestions.c gh-93937, C API: Move PyFrame_GetBack() to Python.h (#93938) 2022-06-19 12:02:33 +02:00
symtable.c bpo-46765: Replace Locally Cached Strings with Statically Initialized Objects (gh-31366) 2022-02-22 17:23:51 -07:00
sysmodule.c gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96499) 2022-09-02 09:35:08 -07:00
thread.c gh-96125: Fix sys.thread_info.name on pthread platforms (GH-96126) 2022-08-19 12:41:25 -07:00
thread_nt.h gh-88750: On Windows, PyThread_acquire_lock() no longer checks for NULL (#92586) 2022-05-10 02:00:38 +02:00
thread_pthread.h gh-95174: Add pthread stubs for WASI (GH-95234) 2022-07-27 20:28:06 +02:00
thread_pthread_stubs.h gh-95174: Add pthread stubs for WASI (GH-95234) 2022-07-27 20:28:06 +02:00
traceback.c gh-93883: elide traceback indicators when possible (#93994) 2022-07-11 07:40:53 +01:00

README 

Miscellaneous source files for the main Python shared library