bpo-45691: Make array of small ints static to fix use-after-free erro… · python/cpython@acc89db · GitHub
Skip to content

Commit acc89db

Browse files
markshannonmarkshannon
authored
bpo-45691: Make array of small ints static to fix use-after-free error. (GH-29366)
1 parent 5a14929 commit acc89db

4 files changed

Lines changed: 31 additions & 45 deletions

File tree

‎Include/internal/pycore_interp.h‎

Lines changed: 0 additions & 14 deletions

‎Include/internal/pycore_long.h‎

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -11,28 +11,15 @@ extern "C" {
1111
#include "pycore_interp.h" // PyInterpreterState.small_ints
1212
#include "pycore_pystate.h" // _PyThreadState_GET()
1313

14-
// Don't call this function but _PyLong_GetZero() and _PyLong_GetOne()
15-
static inline PyObject* __PyLong_GetSmallInt_internal(int value)
16-
{
17-
PyInterpreterState *interp = _PyInterpreterState_GET();
18-
assert(-_PY_NSMALLNEGINTS <= value && value < _PY_NSMALLPOSINTS);
19-
size_t index = _PY_NSMALLNEGINTS + value;
20-
PyObject *obj = (PyObject*)&interp->small_ints[index];
21-
// _PyLong_GetZero(), _PyLong_GetOne() and get_small_int() must not be
22-
// called before _PyLong_Init() nor after _PyLong_Fini().
23-
assert(obj != NULL);
24-
return obj;
25-
}
26-
2714
// Return a borrowed reference to the zero singleton.
2815
// The function cannot return NULL.
2916
static inline PyObject* _PyLong_GetZero(void)
30-
{ return __PyLong_GetSmallInt_internal(0); }
17+
{ return (PyObject *)&_PyRuntime.small_ints[_PY_NSMALLNEGINTS]; }
3118

3219
// Return a borrowed reference to the one singleton.
3320
// The function cannot return NULL.
3421
static inline PyObject* _PyLong_GetOne(void)
35-
{ return __PyLong_GetSmallInt_internal(1); }
22+
{ return (PyObject *)&_PyRuntime.small_ints[_PY_NSMALLNEGINTS+1]; }
3623

3724
PyObject *_PyLong_Add(PyLongObject *left, PyLongObject *right);
3825
PyObject *_PyLong_Multiply(PyLongObject *left, PyLongObject *right);

‎Include/internal/pycore_runtime.h‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,14 @@ extern "C" {
1111
#include "pycore_atomic.h" /* _Py_atomic_address */
1212
#include "pycore_gil.h" // struct _gil_runtime_state
1313

14+
#define _PY_NSMALLPOSINTS 257
15+
#define _PY_NSMALLNEGINTS 5
16+
17+
// _PyLong_GetZero() and _PyLong_GetOne() must always be available
18+
#if _PY_NSMALLPOSINTS < 2
19+
# error "_PY_NSMALLPOSINTS must be greater than 1"
20+
#endif
21+
1422
/* ceval state */
1523

1624
struct _ceval_runtime_state {
@@ -100,6 +108,13 @@ typedef struct pyruntimestate {
100108

101109
unsigned long main_thread;
102110

111+
/* Small integers are preallocated in this array so that they
112+
* can be shared.
113+
* The integers that are preallocated are those in the range
114+
*-_PY_NSMALLNEGINTS (inclusive) to _PY_NSMALLPOSINTS (not inclusive).
115+
*/
116+
PyLongObject small_ints[_PY_NSMALLNEGINTS + _PY_NSMALLPOSINTS];
117+
103118
#define NEXITFUNCS 32
104119
void (*exitfuncs[NEXITFUNCS])(void);
105120
int nexitfuncs;

‎Objects/longobject.c‎

Lines changed: 14 additions & 16 deletions

0 commit comments

Comments
 (0)