py/objint: Fix int.to_bytes() buffer size checks. by projectgus · Pull Request #13087 · micropython/micropython · GitHub
Skip to content

py/objint: Fix int.to_bytes() buffer size checks.#13087

Merged
dpgeorge merged 2 commits into
micropython:masterfrom
projectgus:bugfix/int_to_bytes
Jun 24, 2024
Merged

py/objint: Fix int.to_bytes() buffer size checks.#13087
dpgeorge merged 2 commits into
micropython:masterfrom
projectgus:bugfix/int_to_bytes

Conversation

@projectgus

@projectgus projectgus commented Nov 29, 2023

Copy link
Copy Markdown
Contributor

This "little fix" ended up growing and growing, so this might be too much code size impact. In which case this should be closed. There's a much smaller patch which only fixes the first point from the list below.

  • No longer overflows if byte size is 0 (closes heap-buffer-overflow: from 0 length int_to_bytes #13041)
  • Raises OverflowError in any case where number won't fit into byte length. (Now matches CPython, previously MicroPython would return a truncated bytes object.)
  • Document that micropython int.to_bytes() doesn't implement the optional signed kwarg, but will behave as if signed=True when the integer is negative (this is the current behaviour). Add tests for this also.

Changes are implemented for small ints, MPZ large ints, and "long long" large ints.

Adds a new set of unit tests for ints between 32 and 64 bits to increase coverage of "long long" large ints, which are otherwise untested.

Tested on unix port (64 bit small ints, MPZ long ints) and Zephyr STM32WB board (32 bit small ints, long long large ints).

Untested on a port whose native format is big endian (don't have one at hand).

This work was funded through GitHub Sponsors.

@github-actions

github-actions Bot commented Nov 29, 2023

Copy link
Copy Markdown

@codecov

codecov Bot commented Nov 29, 2023

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.42%. Comparing base (cebc9b0) to head (908ab1c).

Additional details and impacted files
@@           Coverage Diff           @@
##           master   #13087   +/-   ##
=======================================
  Coverage   98.42%   98.42%           
=======================================
  Files         161      161           
  Lines       21234    21248   +14     
=======================================
+ Hits        20900    20914   +14     
  Misses        334      334           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@projectgus projectgus marked this pull request as draft November 29, 2023 02:50
@dpgeorge dpgeorge added the py-core Relates to py/ directory in source label Jan 16, 2024
@projectgus projectgus force-pushed the bugfix/int_to_bytes branch 4 times, most recently from d509c0b to c97d353 Compare April 10, 2024 03:52
@projectgus projectgus marked this pull request as ready for review April 10, 2024 04:07
@dpgeorge dpgeorge added this to the release-1.24.0 milestone Apr 21, 2024
@projectgus projectgus force-pushed the bugfix/int_to_bytes branch 2 times, most recently from 262a9ab to fe533a8 Compare April 30, 2024 07:18
@projectgus projectgus force-pushed the bugfix/int_to_bytes branch 7 times, most recently from dc8c049 to ed3a113 Compare May 1, 2024 06:18
Comment thread py/objint.c
int slen = MP_INT_REPR_LEN(val, val < 0);
memset(data, val < 0 ? 0xFF : 0x00, dlen);
if (slen <= dlen) {
mp_binary_set_int(slen, big_endian, data + (big_endian ? (dlen - slen) : 0), val);

@projectgus projectgus Apr 16, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For later consideration (not this PR): can mp_binary_set_val and this function be combined to save size?

Comment thread py/misc.h Outdated

@projectgus projectgus May 1, 2024

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't really like this approach but it seems the least bad that works across all configurations and isn't too intrusive.

The other way I thought to do it was to only define mp_clz32() and mp_clz64() and then have each port define MP_SIZEOF_INT or a similar macro.

@projectgus

Copy link
Copy Markdown
Contributor Author

@dpgeorge Finally found a combination that works across all ports, I think!

@dpgeorge

Copy link
Copy Markdown
Member

Signed-off-by: Angus Gratton <angus@redyak.com.au>
Fixes and improvements to `int.to_bytes()` are:
- No longer overflows if byte size is 0 (closes micropython#13041).
- Raises OverflowError in any case where number won't fit into byte length
  (now matches CPython, previously MicroPython would return a truncated
  bytes object).
- Document that `micropython int.to_bytes()` doesn't implement the optional
  signed kwarg, but will behave as if `signed=True` when the integer is
  negative (this is the current behaviour).  Add tests for this also.

Requires changes for small ints, MPZ large ints, and "long long" large
ints.

Adds a new set of unit tests for ints between 32 and 64 bits to increase
coverage of "long long" large ints, which are otherwise untested.

Tested on unix port (64 bit small ints, MPZ long ints) and Zephyr STM32WB
board (32 bit small ints, long long large ints).

This work was funded through GitHub Sponsors.

Signed-off-by: Angus Gratton <angus@redyak.com.au>
@dpgeorge dpgeorge force-pushed the bugfix/int_to_bytes branch from ed3a113 to 908ab1c Compare June 24, 2024 04:23
@dpgeorge dpgeorge merged commit 908ab1c into micropython:master Jun 24, 2024
@projectgus projectgus deleted the bugfix/int_to_bytes branch November 1, 2024 05:12
@projectgus projectgus restored the bugfix/int_to_bytes branch November 1, 2024 05:12
@projectgus projectgus deleted the bugfix/int_to_bytes branch November 1, 2024 05:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

py-core Relates to py/ directory in source

Projects

None yet

Development

Successfully merging this pull request may close these issues.

heap-buffer-overflow: from 0 length int_to_bytes

2 participants