-
- Downloads
[3.9] gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96502)
* Correctly pre-check for int-to-str conversion (#96537) Converting a large enough `int` to a decimal string raises `ValueError` as expected. However, the raise comes _after_ the quadratic-time base-conversion algorithm has run to completion. For effective DOS prevention, we need some kind of check before entering the quadratic-time loop. Oops! =) The quick fix: essentially we catch _most_ values that exceed the threshold up front. Those that slip through will still be on the small side (read: sufficiently fast), and will get caught by the existing check so that the limit remains exact. The justification for the current check. The C code check is: ```c max_str_digits / (3 * PyLong_SHIFT) <= (size_a - 11) / 10 ``` In GitHub markdown math-speak, writing $M$ for `max_str_digits`, $L$ for `PyLong_SHIFT` and $s$ for `size_a`, that check is: $$\left\lfloor\frac{M}{3L}\right\rfloor \le \left\lfloor\frac{s - 11}{10}\right\rfloor$$ From this it follows that $$\frac{M}{3L} < \frac{s-1}{10}$$ hence that $$\frac{L(s-1)}{M} > \frac{10}{3} > \log_2(10).$$ So $$2^{L(s-1)} > 10^M.$$ But our input integer $a$ satisfies $|a| \ge 2^{L(s-1)}$, so $|a|$ is larger than $10^M$. This shows that we don't accidentally capture anything _below_ the intended limit in the check. <!-- gh-issue-number: gh-95778 --> * Issue: gh-95778 <!-- /gh-issue-number --> Co-authored-by:Gregory P. Smith [Google LLC] <greg@krypto.org> Co-authored-by:
Christian Heimes <christian@python.org> Co-authored-by:
Mark Dickinson <dickinsm@gmail.com>
Showing
- Doc/data/python3.9.abi 4 additions, 1 deletionDoc/data/python3.9.abi
- Doc/library/functions.rst 8 additions, 0 deletionsDoc/library/functions.rst
- Doc/library/json.rst 11 additions, 0 deletionsDoc/library/json.rst
- Doc/library/stdtypes.rst 159 additions, 0 deletionsDoc/library/stdtypes.rst
- Doc/library/sys.rst 46 additions, 13 deletionsDoc/library/sys.rst
- Doc/library/test.rst 10 additions, 0 deletionsDoc/library/test.rst
- Doc/using/cmdline.rst 13 additions, 0 deletionsDoc/using/cmdline.rst
- Doc/whatsnew/3.9.rst 14 additions, 0 deletionsDoc/whatsnew/3.9.rst
- Include/internal/pycore_initconfig.h 2 additions, 0 deletionsInclude/internal/pycore_initconfig.h
- Include/internal/pycore_interp.h 2 additions, 0 deletionsInclude/internal/pycore_interp.h
- Include/internal/pycore_long.h 49 additions, 0 deletionsInclude/internal/pycore_long.h
- Lib/test/support/__init__.py 11 additions, 0 deletionsLib/test/support/__init__.py
- Lib/test/test_ast.py 8 additions, 0 deletionsLib/test/test_ast.py
- Lib/test/test_cmd_line.py 33 additions, 0 deletionsLib/test/test_cmd_line.py
- Lib/test/test_compile.py 13 additions, 0 deletionsLib/test/test_compile.py
- Lib/test/test_decimal.py 18 additions, 0 deletionsLib/test/test_decimal.py
- Lib/test/test_int.py 196 additions, 0 deletionsLib/test/test_int.py
- Lib/test/test_json/test_decode.py 9 additions, 0 deletionsLib/test/test_json/test_decode.py
- Lib/test/test_sys.py 9 additions, 2 deletionsLib/test/test_sys.py
- Lib/test/test_xmlrpc.py 10 additions, 0 deletionsLib/test/test_xmlrpc.py
Loading
Please register or sign in to comment