Skip to content

gh-161694: Check for integer overflow in PyObject_GC_Resize() - #161908

Closed
vstinner wants to merge 2 commits into
python:mainfrom
vstinner:gc_resize_overflow
Closed

vstinner wants to merge 2 commits into
python:mainfrom
vstinner:gc_resize_overflow

Conversation

@vstinner

@vstinner vstinner commented Nov 12, 2026 •

Copy link
Copy Markdown
Member

Check for integer overflow in PyObject_GC_Resize() and PyObject_GC_NewVar(). Add _PyObject_GC_VAR_SIZE() which is similar to _PyObject_VAR_SIZE() but checks for integer overflow.

Remove redundant (and incomplete) integer overflow from tuple_alloc() and _PyTuple_Resize().

Check for integer overflow in PyObject_GC_Resize() and
_PyObject_GC_NewVar(). Add _PyObject_GC_VAR_SIZE() which is similar
to _PyObject_VAR_SIZE() but checks for integer overflow.

Remove redundant (and incomplete) integer overflow from tuple_alloc()
and _PyTuple_Resize().
@bedevere-app bedevere-app Bot added the type-feature A feature request or enhancement label Nov 12, 2026
@vstinner

Copy link
Copy Markdown
Member Author

It makes me grumpy that _PyObject_GC_NewVar() and _PyObject_GC_Resize() code is basically copied-pasted (with minor changes!) between Python/gc.c and Python/gc_free_threading.c.

The problem is that gc_alloc() code is different and gc_alloc() is a private function. It's uneasy to share code between Python/gc.c and Python/gc_free_threading.c. I tried adding Python/gc_common.c, but I got stuck at gc_alloc(). I tried moving _PyObject_GC_VAR_SIZE() to Include/internal/pycore_gc.c, but _PyType_PreHeaderSize() is a static inline function declared in pycore_object.h which is not included by pycore_gc.h (and including pycore_object.h in pycore_gc.h would create a inter-dependency mess).

So it seems like the best we can do for now is to copy/paste code :-(

@vstinner vstinner removed the type-feature A feature request or enhancement label Nov 12, 2026
@bedevere-app bedevere-app Bot added the type-feature A feature request or enhancement label Nov 12, 2026
@vstinner vstinner added needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes and removed type-feature A feature request or enhancement labels Nov 12, 2026
@vstinner

Copy link
Copy Markdown
Member Author

I searched for _PyObject_VAR_SIZE in PyPI top 15,000 projects (at 2026-09-17). I found 7 projects using _PyObject_VAR_SIZE():

  • cython (3.3.0)
  • jpype1 (1.7.1)
  • nuitka (4.2.1)
  • numpy (2.5.3)
  • orjson (3.12.0)
  • pywinpty (3.0.5)
  • recordclass (0.24.1)

Hum. A more generic approach would be to change _PyObject_VAR_SIZE() instead of changing PyObject_GC_NewVar() and PyObject_GC_Resize().

@vstinner

Copy link
Copy Markdown
Member Author

I close this PR in favor of the more generic #161911.

@vstinner vstinner closed this Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant