gh-152718: Reject oversized table counts in the profiling binary reader by tonghuaroot · Pull Request #152719 · python/cpython · GitHub

This bounds the eager string-table and frame-table allocations in the
_remote_debugging binary profile reader against the file size before
allocating, so a .pyb file whose footer declares an oversized count is
rejected with a ValueError instead of triggering a multi-gigabyte allocation.

Each table entry occupies at least one byte on disk (a string is a >=1-byte
length varint, a frame is six >=1-byte varints plus the opcode byte), so a count
larger than (file_size - table_offset) / MIN_ENTRY_SIZE cannot be backed by
real data. This mirrors the existing RLE-count bound in binary_reader_replay.
Legitimate files are unaffected.

Regression tests in test_binary_format patch the footer counts and assert the
reader rejects both an oversized and a one-past-capacity count, while a count
exactly at the cap still opens.

Issue: _remote_debugging: unbounded allocation when a profiling binary file declares oversized table counts #152718

…y reader

Thanks!

Wondering about a helper. With these two and this one:

cpython/Modules/_remote_debugging/binary_io_reader.c

Lines 1056 to 1066 in ecdef17

    
                       /* Validate RLE count to prevent DoS from malicious files. 
        
                        * Each RLE sample needs at least 2 bytes (1 byte min varint + 1 status byte). 
        
                        * Also reject absurdly large counts that would exhaust memory. */ 
        
                       size_t remaining_data = reader->sample_data_size - offset; 
        
                       size_t max_possible_samples = remaining_data / 2; 
        
                       if (count > max_possible_samples) { 
        
                           PyErr_Format(PyExc_ValueError, 
        
                               "Invalid RLE count %u exceeds maximum possible %zu for remaining data", 
        
                               count, max_possible_samples); 
        
                           return -1; 
        
                       }

it'd be three. Something along the lines of reader_validate_count("RLE", count, reader->sample_data_size - offset, 2) etc.

Generally, wondering about centralizing all these validations in a single place.

Good idea — done in 572947c: the string, frame and RLE checks now share a reader_validate_count(what, count, available, min_entry_size) helper. One heads-up: the RLE call sits in the region #152722 also touches, so whichever lands first the other will need a small rebase there. Thanks!

…count Addresses review feedback: centralize the string/frame/RLE oversized-count validations behind one helper.

@tonghuaroot seems tests are failing can you take a look?

On 32-bit builds a footer frame count of 0xFFFFFFFF overflows the allocation size, so the size_t overflow guard raises OverflowError before the count-vs-file-size guard raises ValueError. Accept either rejection.

Thanks @pablogsal, pushed a fix in 7c23d37. The failure was 32-bit only (Win32 and Emscripten): test_open_rejects_frame_count_larger_than_file patches the frame count to 0xFFFFFFFF, which on a 32-bit build overflows frames_count * sizeof(FrameEntry), so the pre-existing SIZEOF_SIZE_T < 8 guard raises OverflowError before the new count-vs-file-size check raises ValueError. Both reject the file, so I relaxed the test to accept either. Re-running CI now.

Thanks @tonghuaroot for the PR, and @pablogsal for merging it 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖

Thanks for te PR @tonghuaroot

GH-153050 is a backport of this pull request to the 3.15 branch.

…ry reader (GH-152719) (#153050) gh-152718: Reject oversized table counts in the profiling binary reader (GH-152719) (cherry picked from commit 8e580b0) Co-authored-by: tonghuaroot (童话) <tonghuaroot@gmail.com>

pythongh-152718 : Reject oversized table counts in the profiling binar…

6e1023c

…y reader

tonghuaroot requested a review from pablogsal as a code owner July 1, 2026 02:15

bedevere-app Bot added the awaiting review label Jul 1, 2026

bedevere-app Bot mentioned this pull request Jul 1, 2026

_remote_debugging: unbounded allocation when a profiling binary file declares oversized table counts #152718

Closed

pythongh-152718 : Tighten comments and shorten the NEWS entry

ffe2643

pablogsal reviewed Jul 1, 2026

View reviewed changes

maurycy reviewed Jul 2, 2026

View reviewed changes

pythongh-152718 : Factor the reader count checks into reader_validate_…

572947c

…count Addresses review feedback: centralize the string/frame/RLE oversized-count validations behind one helper.

Accept the 32-bit allocation-overflow rejection in the frame-count test

7c23d37

On 32-bit builds a footer frame count of 0xFFFFFFFF overflows the allocation size, so the size_t overflow guard raises OverflowError before the count-vs-file-size guard raises ValueError. Accept either rejection.

Trim the comment on the frame-count rejection test

ce6b056

pablogsal added the needs backport to 3.15 bugs and security fixes label Jul 4, 2026

pablogsal merged commit 8e580b0 into python:main Jul 4, 2026
56 checks passed

bedevere-app Bot removed the awaiting review label Jul 4, 2026

bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Jul 4, 2026

gh-152718: Reject oversized table counts in the profiling binary reader by tonghuaroot · Pull Request #152719 · python/cpython · GitHub

Repository navigation

gh-152718: Reject oversized table counts in the profiling binary reader - #152719

gh-152718: Reject oversized table counts in the profiling binary reader#152719
pablogsal merged 5 commits into
python:mainfrom
tonghuaroot:fix-profiling-reader-alloc

tonghuaroot commented Jul 1, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

Uh oh!

pablogsal left a comment

Uh oh!

maurycy Jul 2, 2026 •
edited
Loading

Uh oh!

Uh oh!

tonghuaroot Jul 2, 2026

Uh oh!

pablogsal commented Jul 4, 2026

Uh oh!

tonghuaroot commented Jul 4, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented Jul 4, 2026

Uh oh!

pablogsal commented Jul 4, 2026

Uh oh!

bedevere-app Bot commented Jul 4, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

                   }
               #endif
+                  size_t max_frames =

	/* Validate RLE count to prevent DoS from malicious files.
	* Each RLE sample needs at least 2 bytes (1 byte min varint + 1 status byte).
	* Also reject absurdly large counts that would exhaust memory. */
	size_t remaining_data = reader->sample_data_size - offset;
	size_t max_possible_samples = remaining_data / 2;
	if (count > max_possible_samples) {
	PyErr_Format(PyExc_ValueError,
	"Invalid RLE count %u exceeds maximum possible %zu for remaining data",
	count, max_possible_samples);
	return -1;
	}

gh-152718: Reject oversized table counts in the profiling binary reader by tonghuaroot · Pull Request #152719 · python/cpython · GitHub

Repository navigation

gh-152718: Reject oversized table counts in the profiling binary reader - #152719

gh-152718: Reject oversized table counts in the profiling binary reader#152719pablogsal merged 5 commits intopython:mainpython/cpython:mainfrom tonghuaroot:fix-profiling-reader-alloctonghuaroot/cpython:fix-profiling-reader-allocCopy head branch name to clipboard

Conversation

tonghuaroot commented Jul 1, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pablogsal left a comment

Choose a reason for hiding this comment

Uh oh!

maurycy Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tonghuaroot Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

pablogsal commented Jul 4, 2026

Uh oh!

tonghuaroot commented Jul 4, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented Jul 4, 2026

Uh oh!

pablogsal commented Jul 4, 2026

Uh oh!

bedevere-app Bot commented Jul 4, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gh-152718: Reject oversized table counts in the profiling binary reader#152719
pablogsal merged 5 commits into
python:mainfrom
tonghuaroot:fix-profiling-reader-alloc

tonghuaroot commented Jul 1, 2026 •
edited by bedevere-app Bot
Loading

maurycy Jul 2, 2026 •
edited
Loading