homepage

This issue tracker has been migrated to GitHub , and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: dictobject.c:dictresize() vulnerability
Type: Stage:
Components: Interpreter Core Versions:
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: arigo, tim.peters
Priority: normal Keywords:

Created on 2006年03月22日 15:47 by arigo, last changed 2022年04月11日 14:56 by admin. This issue is now closed.

Files
File name Uploaded Description Edit
test1.py arigo, 2006年03月22日 15:47 Crashing example (all Python versions)
dictresize-fix-1.diff arigo, 2006年03月22日 16:32 proposed fix
Messages (5)
msg27842 - (view) Author: Armin Rigo (arigo) * (Python committer) Date: 2006年03月22日 15:47
We thought we squashed the last of the
modify-the-dict-from-a-custom-eq kind of bugs long ago. 
Too bad.
msg27843 - (view) Author: Armin Rigo (arigo) * (Python committer) Date: 2006年03月22日 16:32
Logged In: YES 
user_id=4771
The cause of the bug is that if oldtable == mp->ma_smalltable
then pure Python code can mangle with mp->ma_smalltable while
it is being walked on. A simple fix would be to always make
a copy of the oldtable if it is mp->ma_smalltable (not only
if oldtable == newtable).
Attached a more efficient fix, which should also make dict
resizing somehow faster. It requires yet another version
of the lookup algorithm, though. It's a very simple version
that assumes that all items are different and the dict
contains no dummy entries.
msg27844 - (view) Author: Armin Rigo (arigo) * (Python committer) Date: 2006年06月01日 13:20
Logged In: YES 
user_id=4771
Fixed by patch #1497053.
msg27845 - (view) Author: Tim Peters (tim.peters) * (Python committer) Date: 2006年06月01日 15:54
Logged In: YES 
user_id=31435
Patch 1497053 was checked in as revision 46589 of the trunk
for Python 2.5, so closing this. I doubt it's worth the
effort to backport to 2.4.
msg27846 - (view) Author: Tim Peters (tim.peters) * (Python committer) Date: 2006年10月09日 20:29
Logged In: YES 
user_id=31435
I backported the parts of rev 46589 relevant to this bug to
the 2.4 maint branch, as rev 52256, for Python 2.4.4.
History
Date User Action Args
2022年04月11日 14:56:16adminsetgithub: 43071
2006年03月22日 15:47:18arigocreate

AltStyle によって変換されたページ (->オリジナル) /