Repository navigation
Add overflow checks before calling memory allocators #127681
Description
Bug report
Bug description:
From capi-workgroup/decisions#50 (comment) and capi-workgroup/decisions#50 (comment).
Some calls to the PyMem_* API uses an arithmetic operation on the size, which could make the requested length overflow. The checks in the corresponding functions would not be relevant since the inputs already overflowed.
See #127686 (comment) for the future of this issue.
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Activity
serhiy-storchaka commentedon Dec 6, 2024
In most cases there is such check (I myself added and reviewed miriads of checks). If it is forgotten in some case, it is a bug.
picnixz commentedon Dec 6, 2024
I've found quite a lot of code that does not check them. There are some parts that do not need such checks because of some assumptions (e.g., when converting numbers to string, we likely won't have more digits than SIZE_MAX).
EDIT: I'll create a fresh branch without comments and with the minimal checks.
pranavchoudhary-tech commentedon Jul 10, 2026
I'll take a look at this and work on a PR to address the remaining overflow checks.
Fix overflow vulnerabilities in PyMem_Malloc calls (python#127681)