Skip to content

Fix 33 reproduced fuzzing and static-review defects #8514

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
youknowone merged 40 commits into from
Aug 13, 2026
Merged

Fix 33 reproduced fuzzing and static-review defects #8514

Changes from 1 commit
Commits
Show all changes
40 commits
Select commit Hold shift + click to select a range
6afa8ad
mmap: guard move() against dest/src past the mapping size
youknowone Aug 13, 2026
d0cc9b2
exceptions: keep ImportError name/path/name_from out of an empty inst…
youknowone Aug 13, 2026
3cdca38
asyncio: stop unwrapping the _current_tasks downcast in current_task()
youknowone Aug 13, 2026
8525e5a
asyncio: raise TypeError when FutureIter.throw()'s exception class re…
youknowone Aug 13, 2026
4f09fc9
sequence: use a fallible reservation for sequence repetition
youknowone Aug 13, 2026
4555824
collections: reject an oversized deque repetition with MemoryError
youknowone Aug 13, 2026
5fc6713
itertools: raise OverflowError for an out-of-range r argument
youknowone Aug 13, 2026
7ca0170
math: stream the generic sumprod path instead of collecting both iter…
youknowone Aug 13, 2026
e10a9dc
_imp: raise TypeError for a second positional argument to find_frozen
youknowone Aug 13, 2026
a625bb7
_typing: check _idfunc arity before indexing args
youknowone Aug 13, 2026
3a5a6bf
exceptions: require a sequence for the ExceptionGroup excs argument
youknowone Aug 13, 2026
8074cd2
mmap: treat an inverted find/rfind range as empty
youknowone Aug 13, 2026
4bfb4e5
collections: give deque and defaultdict a GC traverse
youknowone Aug 13, 2026
b84a311
itertools: opt the iterator types into GC traverse
youknowone Aug 13, 2026
126a1f7
_ctypes: mask an out-of-range int instead of panicking
youknowone Aug 13, 2026
18be6c8
hashlib: import _hashlib when a hash module is loaded
youknowone Aug 13, 2026
12c1e5b
_csv: fall back to the built-in dialect defaults when none is registered
youknowone Aug 13, 2026
737ded1
builtins: reject surrogates in compile()/eval() source instead of pan…
youknowone Aug 13, 2026
12186b0
_suggestions: require a list for _generate_suggestions candidates
youknowone Aug 13, 2026
06229d8
lzma: size the filter chain before consuming it
youknowone Aug 13, 2026
56d1054
classmethod: opt into GC traverse
youknowone Aug 13, 2026
131c89c
posix: reject unbounded iterables in posix_spawn and setgroups
youknowone Aug 13, 2026
f8c3167
_ctypes: size Array slice assignment and _argtypes_ before collecting
youknowone Aug 13, 2026
cb3c217
sys: propagate the breakpointhook warning failure
youknowone Aug 13, 2026
2ab38ec
structseq: require the sequence argument when constructing a struct s…
youknowone Aug 13, 2026
98a62d2
Guard the hash slot dispatch against unbounded recursion
youknowone Aug 13, 2026
2e1173b
genericalias: guard the __parameters__ walk against unbounded recursion
youknowone Aug 13, 2026
661b1af
Fix the type confusion in PyAtomicRef's Debug impl
youknowone Aug 13, 2026
eefb38b
_sre: disallow instantiating Match
youknowone Aug 13, 2026
0ca5a81
utils: return the empty repr instead of asserting a non-empty collection
youknowone Aug 13, 2026
3d8b930
itertools: advance cycle's index atomically
youknowone Aug 13, 2026
bce0970
_ctypes: reject a float argument to a foreign call without argtypes
youknowone Aug 13, 2026
95ef3f7
Report the iterator itself from PyIter's traverse
youknowone Aug 13, 2026
ead3b16
Remove the obsolete expectedFailure on test_code_module.test_unicode_…
youknowone Aug 13, 2026
c6b4df3
itertools: reserve the combination indices fallibly
youknowone Aug 13, 2026
cc6a434
Apply the struct sequence constructor's dict argument
youknowone Aug 13, 2026
f6808a2
_imp: report the argument count in find_frozen's arity error
youknowone Aug 13, 2026
1340654
Add regression tests for the reproduced crashers
youknowone Aug 13, 2026
bbe08af
Tolerate a changed-size RuntimeError in the set repr stress test
youknowone Aug 13, 2026
6545c58
Move the crash regression tests into per-module snippets
youknowone Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
builtins: reject surrogates in compile()/eval() source instead of pan… 
…icking

expect_str() panics on a str containing surrogates; convert with try_as_utf8
so eval(chr(0xd800)) raises.

Assisted-by: Claude
  • Loading branch information
@youknowone
youknowone committed Aug 13, 2026
commit 737ded11be4a88855f5c5e241c9e41bc52c2e72d
7 changes: 5 additions & 2 deletions crates/vm/src/stdlib/builtins.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -341,6 +341,7 @@ mod builtins {
};
match &source {
ArgStrOrBytesLike::Str(source) => {
let source = source.try_as_utf8(vm)?.as_str();
if source.as_bytes().contains(&0) {
return Err(vm.new_exception_msg(
vm.ctx.exceptions.syntax_error.to_owned(),
Expand Down Expand Up @@ -548,13 +549,14 @@ mod builtins {
Either::A(either) => {
let source = match &either {
ArgStrOrBytesLike::Str(source) => {
let source = source.try_as_utf8(vm)?.as_str();
if source.as_bytes().contains(&0) {
return Err(vm.new_exception_msg(
vm.ctx.exceptions.syntax_error.to_owned(),
"source code string cannot contain null bytes".into(),
));
}
let source = source.expect_str().trim_start_matches([' ', '\t']);
let source = source.trim_start_matches([' ', '\t']);
audit_compile_source(vm, source.as_bytes(), "<string>")?;
source.to_owned()
}
Expand Down Expand Up @@ -597,14 +599,15 @@ mod builtins {
}
let source = match &either {
ArgStrOrBytesLike::Str(source) => {
let source = source.try_as_utf8(vm)?.as_str();
if source.as_bytes().contains(&0) {
return Err(vm.new_exception_msg(
vm.ctx.exceptions.syntax_error.to_owned(),
"source code string cannot contain null bytes".into(),
));
}
audit_compile_source(vm, source.as_bytes(), "<string>")?;
source.expect_str().to_owned()
source.to_owned()
}
ArgStrOrBytesLike::Buf(source) => {
let source: &[u8] = &source.borrow_buf();
Expand Down