mirrors
/
cpython
mirror of https://github.com/python/cpython.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
115,422 Commits 6 Branches 604 Tags 2.9 GiB
Commit Graph

8 Commits

Author SHA1 Message Date
Gregory P. Smith f8b71da9aa
[3.11] gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96500) 
Integer to and from text conversions via CPython's bignum `int` type is not safe against denial of service attacks due to malicious input. Very large input strings with hundred thousands of digits can consume several CPU seconds.

This PR comes fresh from a pile of work done in our private PSRT security response team repo.

This backports https://github.com/python/cpython/pull/96499 aka 511ca94520

Signed-off-by: Christian Heimes [Red Hat] <christian@python.org>
Tons-of-polishing-up-by: Gregory P. Smith [Google] <greg@krypto.org>
Reviews via the private PSRT repo via many others (see the NEWS entry in the PR).

<!-- gh-issue-number: gh-95778 -->
* Issue: gh-95778
<!-- /gh-issue-number -->

I wrote up [a one pager for the release managers](https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y/edit#).
 2022-09-02 09:48:57 -07:00
Miss Islington (bot) 86eb500068
[3.11] gh-95185: Check recursion depth in the AST constructor (GH-95186) (GH-95208) 
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
(cherry picked from commit 0047447294)

Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
 2022-07-26 12:19:22 +02:00
Mark Shannon 3b4f5ed168
[3.11] GH-93516: Backport GH-93769 (GH-94231) 
* Store offset of first traceable instruction to avoid having to recompute it all the time when tracing.
 2022-06-28 16:30:22 +01:00
Ken Jin 852b4d4bcd
[3.11] gh-93382: Cache result of `PyCode_GetCode` in codeobject (GH-93383) (#93493) 
Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com>
Co-authored-by: Dennis Sweeney <36520290+sweeneyde@users.noreply.github.com>
 2022-06-23 17:24:49 +01:00
Mark Shannon 3ece6e6feb
[3.11] GH-93516: Backport GH-93769: Speedup line number checks when tracing (GH-94127) 
Co-authored-by: Pablo Galindo <pablogsal@gmail.com>
 2022-06-22 16:32:02 +01:00
Miss Islington (bot) 8dc5df4e21
[3.11] gh-91162: Support splitting of unpacked arbitrary-length tuple over TypeVar and TypeVarTuple parameters (alt) (GH-93412) (GH-93746) 
For example:

  A[T, *Ts][*tuple[int, ...]] -> A[int, *tuple[int, ...]]
  A[*Ts, T][*tuple[int, ...]] -> A[*tuple[int, ...], int]
(cherry picked from commit 3473817106)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
 2022-06-14 21:15:56 +03:00
Miss Islington (bot) 00f8fe9564
[3.11] gh-91162: Fix substitution of unpacked tuples in generic aliases (GH-92335) (#92484) 
* gh-91162: Fix substitution of unpacked tuples in generic aliases (GH-92335)
(cherry picked from commit 9d25db9db1)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

* Regenerate ABI file

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Pablo Galindo <pablogsal@gmail.com>
 2022-06-01 03:13:27 +01:00
Pablo Galindo Salgado e89c01eac7
[3.11] Add CI step to check changes in the exported ABI (#92442) 2022-05-08 04:32:17 +01:00