[issue24620] Segfault with nonsensical random state

Changes by Serhiy Storchaka : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___ _

[issue24620] Segfault with nonsensical random state

Roundup Robot added the comment: New changeset 0933c00c2765 by Serhiy Storchaka in branch '3.4': Issue #24620: Random.setstate() now validates the value of state last element. https://hg.python.org/cpython/rev/0933c00c2765 New changeset 84070c1225c5 by Serhiy Storchaka in branch '2.7': Issue #24

[issue24620] Segfault with nonsensical random state

Raymond Hettinger added the comment: This is ready to apply. -- assignee: rhettinger -> serhiy.storchaka ___ Python tracker ___ ___ Py

[issue24620] Segfault with nonsensical random state

Changes by Raymond Hettinger : -- assignee: -> rhettinger ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http

[issue24620] Segfault with nonsensical random state

Serhiy Storchaka added the comment: But I can reproduce the crash with other example. import random random.setstate((3, (1,)*624+(-10**9,), None)) random.random() The index attribute can be set to negative value and this causes reading out of the buffer. Here is a patch that fixes this.

[issue24620] Segfault with nonsensical random state

Stefan Krah added the comment: I think it's just a matter of checking for self->index <= N in setstate(). -- ___ Python tracker ___ __

[issue24620] Segfault with nonsensical random state

Serhiy Storchaka added the comment: Can't reproduce on 32-bit. -- components: +Extension Modules nosy: +serhiy.storchaka stage: -> needs patch type: -> crash ___ Python tracker ___

[issue24620] Segfault with nonsensical random state

New submission from Stefan Krah: While trying to find a possible cause for #24546, I came across this glitch: Python 3.6.0a0 (default:02b81a82a57d, Jul 12 2015, 20:33:44) [GCC 4.8.4] on linux Type "help", "copyright", "credits" or "license" for more information. >>> import random >>> s = (3, (9