Skip to content

gh-120155: Fix Coverity issue in parse_string() #120997

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pablogsal merged 1 commit into from
Jun 25, 2024
Merged

gh-120155: Fix Coverity issue in parse_string() #120997

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
gh-120155: Fix Coverity issue in parse_string() 
Add an assertion to make sure that the 'len' variable is at least 1,
to make sure that the code '--len' below is safe.

Fix the Coverity issue on Python-3.12.2:

Error: INTEGER_OVERFLOW (CWE-190):
Parser/string_parser.c:236:5: underflow: The decrement operator on
    the unsigned variable "len" might result in an underflow.
Parser/string_parser.c:246:9: overflow: The expression "len -= 2UL"
    is deemed underflowed because at least one of its arguments has
    underflowed.
Parser/string_parser.c:269:13: overflow_sink: "len", which might
    have underflowed, is passed to
    "PyBytes_FromStringAndSize(s, len)".
  267|           }
  268|           if (rawmode) {
  269|->             return PyBytes_FromStringAndSize(s, len);
  270|           }
  271|           return decode_bytes_with_escapes(p, s, len, t);
  • Loading branch information
@vstinner
vstinner committed Jun 25, 2024
commit bda62ba56567b5d278446f6bcd45b7bac53ae29e
5 changes: 5 additions & 0 deletions Parser/string_parser.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,9 +229,14 @@ _PyPegen_parse_string(Parser *p, Token *t)
PyErr_BadInternalCall();
return NULL;
}

/* Skip the leading quote char. */
s++;
len = strlen(s);
// gh-120155: 's' contains at least the trailing quote,
// so the code '--len' below is safe.
assert(len >= 1);

if (len > INT_MAX) {
PyErr_SetString(PyExc_OverflowError, "string to parse is too long");
return NULL;
Expand Down