Skip to content

gh-161694: Check for integer overflow in _PyObject_VAR_SIZE() - #161911

Open
vstinner wants to merge 7 commits into
python:mainfrom
vstinner:object_var_size
Open

vstinner wants to merge 7 commits into
python:mainfrom
vstinner:object_var_size

Conversation

@vstinner

@vstinner vstinner commented Nov 12, 2026 •

Copy link
Copy Markdown
Member

Check also for integer overflow in _PyType_AllocNoTrack().

Remove redundant (and incomplete) integer overflow from tuple_alloc() and _PyTuple_Resize().

Check also for integer overflow in _PyType_AllocNoTrack().

Remove redundant (and incomplete) integer overflow from tuple_alloc()
and _PyTuple_Resize().
@bedevere-app bedevere-app Bot added the type-feature A feature request or enhancement label Nov 12, 2026
@vstinner vstinner removed the type-feature A feature request or enhancement label Nov 12, 2026
@vstinner

Copy link
Copy Markdown
Member Author

I wrote a first PR #161908 to detect integer overflow in PyObject_GC_NewVar() and PyObject_GC_Resize().

Then I searched for _PyObject_VAR_SIZE in PyPI top 15,000 projects (at 2026-09-17) and I found 7 projects using _PyObject_VAR_SIZE():

  • cython (3.3.0)
  • jpype1 (1.7.1)
  • nuitka (4.2.1)
  • numpy (2.5.3)
  • orjson (3.12.0)
  • pywinpty (3.0.5)
  • recordclass (0.24.1)

So instead of changing PyObject_GC_NewVar() and PyObject_GC_Resize(), I wrote this PR which is more generic to change _PyObject_VAR_SIZE(). It fixes PyObject_GC_NewVar() and PyObject_GC_Resize(), but also all projects calling directly _PyObject_VAR_SIZE().

In debug mode, check also that nitems >= 0 in _PyType_AllocNoTrack()
and _PyObject_GC_Resize().
@bedevere-app bedevere-app Bot added the type-feature A feature request or enhancement label Nov 12, 2026
Fix compiler warning:

    Include/cpython/objimpl.h:31:5: error: ISO C90 forbids mixed
    declarations and code [-Werror=declaration-after-statement]
Don't compute nitems * itemsize if tp_itemsize is zero.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

awaiting core review type-feature A feature request or enhancement

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant