Repository navigation
Commit eb4c78d
authored
Compute ``final_depth`` in ``decode_stack_pop_push()`` and
``decode_stack_suffix()`` using ``uint64_t`` before validating it.
On 32-bit builds, using ``size_t`` arithmetic for ``keep + push`` can wrap
for large input values, causing the later bounds check to validate the wrong
final depth. Using a widened type keeps the validation aligned with the
actual result.
1 parent 2662db0 commit eb4c78d
2 files changed
Lines changed: 23 additions & 12 deletions
File tree
- Misc/NEWS.d/next/Security
- Modules/_remote_debugging
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,3 @@ | |||
| 1 | + Fixed stack depth calculation in :mod:`!_remote_debugging` when decoding | ||
| 2 | + certain ``.pyb`` inputs on 32-bit builds. Issue originally identified and | ||
| 3 | + diagnosed by Tristan Madani (@TristanInSec on GitHub). | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -601,6 +601,20 @@ reader_get_or_create_thread_state(BinaryReader *reader, uint64_t thread_id, | |||
| 601 | 601 | * STACK DECODING HELPERS | |
| 602 | 602 | * ============================================================================ */ | |
| 603 | 603 | ||
| 604 | + /* Validate that final_depth fits in the stack buffer. | ||
| 605 | + * Uses uint64_t to prevent overflow on 32-bit platforms. */ | ||
| 606 | + static inline int | ||
| 607 | + validate_stack_depth(ReaderThreadState *ts, uint64_t final_depth) | ||
| 608 | + { | ||
| 609 | + if (final_depth > ts->current_stack_capacity) { | ||
| 610 | + PyErr_Format(PyExc_ValueError, | ||
| 611 | + "Final stack depth %llu exceeds capacity %zu", | ||
| 612 | + (unsigned long long)final_depth, ts->current_stack_capacity); | ||
| 613 | + return -1; | ||
| 614 | + } | ||
| 615 | + return 0; | ||
| 616 | + } | ||
| 617 | + | ||
| 604 | 618 | /* Decode a full stack from sample data. | |
| 605 | 619 | * Updates ts->current_stack and ts->current_stack_depth. | |
| 606 | 620 | * Returns 0 on success, -1 on error (bounds violation). */ | |
@@ -658,12 +672,9 @@ decode_stack_suffix(ReaderThreadState *ts, const uint8_t *data, | |||
| 658 | 672 | return -1; | |
| 659 | 673 | } | |
| 660 | 674 | ||
| 661 | - /* Validate final depth doesn't exceed capacity */ | ||
| 662 | - size_t final_depth = (size_t)shared + new_count; | ||
| 663 | - if (final_depth > ts->current_stack_capacity) { | ||
| 664 | - PyErr_Format(PyExc_ValueError, | ||
| 665 | - "Final stack depth %zu exceeds capacity %zu", | ||
| 666 | - final_depth, ts->current_stack_capacity); | ||
| 675 | + /* Use uint64_t to prevent overflow on 32-bit platforms */ | ||
| 676 | + uint64_t final_depth = (uint64_t)shared + new_count; | ||
| 677 | + if (validate_stack_depth(ts, final_depth) < 0) { | ||
| 667 | 678 | return -1; | |
| 668 | 679 | } | |
| 669 | 680 | ||
@@ -713,12 +724,9 @@ decode_stack_pop_push(ReaderThreadState *ts, const uint8_t *data, | |||
| 713 | 724 | } | |
| 714 | 725 | size_t keep = (ts->current_stack_depth > pop) ? ts->current_stack_depth - pop : 0; | |
| 715 | 726 | ||
| 716 | - /* Validate final depth doesn't exceed capacity */ | ||
| 717 | - size_t final_depth = keep + push; | ||
| 718 | - if (final_depth > ts->current_stack_capacity) { | ||
| 719 | - PyErr_Format(PyExc_ValueError, | ||
| 720 | - "Final stack depth %zu exceeds capacity %zu", | ||
| 721 | - final_depth, ts->current_stack_capacity); | ||
| 727 | + /* Use uint64_t to prevent overflow on 32-bit platforms */ | ||
| 728 | + uint64_t final_depth = (uint64_t)keep + push; | ||
| 729 | + if (validate_stack_depth(ts, final_depth) < 0) { | ||
| 722 | 730 | return -1; | |
| 723 | 731 | } | |
| 724 | 732 | ||
0 commit comments