[issue23365] integer overflow in itertools.combinations_with_replacement
Roundup Robot added the comment: New changeset 887526ebb013 by Serhiy Storchaka in branch '2.7': Issues #23363, #23364, #23365, #23366: Fixed itertools overflow tests. https://hg.python.org/cpython/rev/887526ebb013 -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23365 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue23365] integer overflow in itertools.combinations_with_replacement
Changes by Arfrever Frehtes Taifersar Arahesis arfrever@gmail.com: -- versions: +Python 2.7, Python 3.3, Python 3.5 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23365 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue23365] integer overflow in itertools.combinations_with_replacement
Roundup Robot added the comment: New changeset 356ed025dbae by Serhiy Storchaka in branch '3.3': Issues #23363, #23364, #23365, #23366: Fixed itertools overflow tests. https://hg.python.org/cpython/rev/356ed025dbae New changeset 98c720c3e061 by Serhiy Storchaka in branch '3.4': Issues #23363, #23364, #23365, #23366: Fixed itertools overflow tests. https://hg.python.org/cpython/rev/98c720c3e061 New changeset 4cb316fe6bf2 by Serhiy Storchaka in branch 'default': Issues #23363, #23364, #23365, #23366: Fixed itertools overflow tests. https://hg.python.org/cpython/rev/4cb316fe6bf2 -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23365 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue23365] integer overflow in itertools.combinations_with_replacement
Changes by Serhiy Storchaka storch...@gmail.com: -- status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23365 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue23365] integer overflow in itertools.combinations_with_replacement
New submission from paul: # Bug # --- # # static PyObject * # cwr_new(PyTypeObject *type, PyObject *args, PyObject *kwds) # { # ... # 1 indices = PyMem_Malloc(r * sizeof(Py_ssize_t)); # ... # for (i=0 ; ir ; i++) # 2 indices[i] = 0; # # # 1. if r=2^30, then r*sizeof(Py_ssize_t)=2^30*2^2=0 (modulo 2^32), so malloc #allocates a 0 byte buffer # 2. r=2^300, so we write well beyond the buffer's end # # Crash # - # # Breakpoint 1, cwr_new (type=0x83392a0 cwr_type, args=('AA', 1073741824), kwds=0x0) at ./Modules/itertoolsmodule.c:2684 # 2684PyObject *pool = NULL; # ... # 2703indices = PyMem_Malloc(r * sizeof(Py_ssize_t)); # (gdb) print r # $1 = 1073741824 # (gdb) print r*4 # $2 = 0 # (gdb) c # Continuing. # # Program received signal SIGSEGV, Segmentation fault. # 0x0822fdcd in cwr_new (type=0x83392a0 cwr_type, args=('AA', 1073741824), kwds=0x0) at ./Modules/itertoolsmodule.c:2710 # 2710indices[i] = 0; # # OS info # --- # # % ./python -V # Python 3.4.1 # # % uname -a # Linux ubuntu 3.8.0-29-generic #42~precise1-Ubuntu SMP Wed Aug 14 15:31:16 UTC 2013 i686 i686 i386 GNU/Linux # import itertools as it it.combinations_with_replacement(AA, 2**30) -- files: poc_cwr.py messages: 235173 nosy: pkt priority: normal severity: normal status: open title: integer overflow in itertools.combinations_with_replacement type: crash versions: Python 3.4 Added file: http://bugs.python.org/file37964/poc_cwr.py ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23365 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue23365] integer overflow in itertools.combinations_with_replacement
Changes by Arfrever Frehtes Taifersar Arahesis arfrever@gmail.com: -- nosy: +Arfrever ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23365 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue23365] integer overflow in itertools.combinations_with_replacement
Roundup Robot added the comment: New changeset 93d445cd5f70 by Benjamin Peterson in branch '3.3': check for overflow in combinations_with_replacement (closes #23365) https://hg.python.org/cpython/rev/93d445cd5f70 New changeset 2e7a02e4cf2c by Benjamin Peterson in branch '3.4': merge 3.3 (#23365) https://hg.python.org/cpython/rev/2e7a02e4cf2c New changeset 4d875a690c01 by Benjamin Peterson in branch 'default': merge 3.4 (#23365) https://hg.python.org/cpython/rev/4d875a690c01 New changeset 366018a91457 by Benjamin Peterson in branch '2.7': check for overflow in combinations_with_replacement (closes #23365) https://hg.python.org/cpython/rev/366018a91457 -- nosy: +python-dev resolution: - fixed stage: - resolved status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23365 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue23365] integer overflow in itertools.combinations_with_replacement
Serhiy Storchaka added the comment: The test needs 4GiB. May be use 2**29? -- nosy: +serhiy.storchaka ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23365 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue23365] integer overflow in itertools.combinations_with_replacement
Changes by Serhiy Storchaka storch...@gmail.com: -- status: closed - open ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23365 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com