Mailman 3 January 2025 - Python-checkins

gh-111178: fix UBSan failures in `Python/bltinmodule.c` (GH-128235)
by encukou Jan. 10, 2025

Jan. 10, 2025

https://github.com/python/cpython/commit/28ffdc5702e8e5d71d7b06e389d1619c0a… commit: 28ffdc5702e8e5d71d7b06e389d1619c0ae9a4ae branch: main author: Bénédikt Tran <10796600+picnixz(a)users.noreply.github.com> committer: encukou <encukou(a)gmail.com> date: 2025-01-10T11:51:24+01:00 summary: gh-111178: fix UBSan failures in `Python/bltinmodule.c` (GH-128235) * fix UBSan failures for `filterobject` * fix UBSan failures for `mapobject` * fix UBSan failures for `zipobject` files: M Python/bltinmodule.c diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c index fb9868b3740b8c..46a6fd9a8ef017 100644 --- a/Python/bltinmodule.c +++ b/Python/bltinmodule.c @@ -494,6 +494,8 @@ typedef struct { PyObject *it; } filterobject; +#define _filterobject_CAST(op) ((filterobject *)(op)) + static PyObject * filter_new(PyTypeObject *type, PyObject *args, PyObject *kwds) { @@ -559,8 +561,9 @@ filter_vectorcall(PyObject *type, PyObject * const*args, } static void -filter_dealloc(filterobject *lz) +filter_dealloc(PyObject *self) { + filterobject *lz = _filterobject_CAST(self); PyObject_GC_UnTrack(lz); Py_TRASHCAN_BEGIN(lz, filter_dealloc) Py_XDECREF(lz->func); @@ -570,16 +573,18 @@ filter_dealloc(filterobject *lz) } static int -filter_traverse(filterobject *lz, visitproc visit, void *arg) +filter_traverse(PyObject *self, visitproc visit, void *arg) { + filterobject *lz = _filterobject_CAST(self); Py_VISIT(lz->it); Py_VISIT(lz->func); return 0; } static PyObject * -filter_next(filterobject *lz) +filter_next(PyObject *self) { + filterobject *lz = _filterobject_CAST(self); PyObject *item; PyObject *it = lz->it; long ok; @@ -613,15 +618,16 @@ filter_next(filterobject *lz) } static PyObject * -filter_reduce(filterobject *lz, PyObject *Py_UNUSED(ignored)) +filter_reduce(PyObject *self, PyObject *Py_UNUSED(ignored)) { + filterobject *lz = _filterobject_CAST(self); return Py_BuildValue("O(OO)", Py_TYPE(lz), lz->func, lz->it); } PyDoc_STRVAR(reduce_doc, "Return state information for pickling."); static PyMethodDef filter_methods[] = { - {"__reduce__", _PyCFunction_CAST(filter_reduce), METH_NOARGS, reduce_doc}, + {"__reduce__", filter_reduce, METH_NOARGS, reduce_doc}, {NULL, NULL} /* sentinel */ }; @@ -638,7 +644,7 @@ PyTypeObject PyFilter_Type = { sizeof(filterobject), /* tp_basicsize */ 0, /* tp_itemsize */ /* methods */ - (destructor)filter_dealloc, /* tp_dealloc */ + filter_dealloc, /* tp_dealloc */ 0, /* tp_vectorcall_offset */ 0, /* tp_getattr */ 0, /* tp_setattr */ @@ -656,12 +662,12 @@ PyTypeObject PyFilter_Type = { Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC | Py_TPFLAGS_BASETYPE, /* tp_flags */ filter_doc, /* tp_doc */ - (traverseproc)filter_traverse, /* tp_traverse */ + filter_traverse, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ PyObject_SelfIter, /* tp_iter */ - (iternextfunc)filter_next, /* tp_iternext */ + filter_next, /* tp_iternext */ filter_methods, /* tp_methods */ 0, /* tp_members */ 0, /* tp_getset */ @@ -674,7 +680,7 @@ PyTypeObject PyFilter_Type = { PyType_GenericAlloc, /* tp_alloc */ filter_new, /* tp_new */ PyObject_GC_Del, /* tp_free */ - .tp_vectorcall = (vectorcallfunc)filter_vectorcall + .tp_vectorcall = filter_vectorcall }; @@ -1319,6 +1325,8 @@ typedef struct { int strict; } mapobject; +#define _mapobject_CAST(op) ((mapobject *)(op)) + static PyObject * map_new(PyTypeObject *type, PyObject *args, PyObject *kwds) { @@ -1422,8 +1430,9 @@ map_vectorcall(PyObject *type, PyObject * const*args, } static void -map_dealloc(mapobject *lz) +map_dealloc(PyObject *self) { + mapobject *lz = _mapobject_CAST(self); PyObject_GC_UnTrack(lz); Py_XDECREF(lz->iters); Py_XDECREF(lz->func); @@ -1431,16 +1440,18 @@ map_dealloc(mapobject *lz) } static int -map_traverse(mapobject *lz, visitproc visit, void *arg) +map_traverse(PyObject *self, visitproc visit, void *arg) { + mapobject *lz = _mapobject_CAST(self); Py_VISIT(lz->iters); Py_VISIT(lz->func); return 0; } static PyObject * -map_next(mapobject *lz) +map_next(PyObject *self) { + mapobject *lz = _mapobject_CAST(self); Py_ssize_t i; PyObject *small_stack[_PY_FASTCALL_SMALL_STACK]; PyObject **stack; @@ -1523,8 +1534,9 @@ map_next(mapobject *lz) } static PyObject * -map_reduce(mapobject *lz, PyObject *Py_UNUSED(ignored)) +map_reduce(PyObject *self, PyObject *Py_UNUSED(ignored)) { + mapobject *lz = _mapobject_CAST(self); Py_ssize_t numargs = PyTuple_GET_SIZE(lz->iters); PyObject *args = PyTuple_New(numargs+1); Py_ssize_t i; @@ -1545,19 +1557,20 @@ map_reduce(mapobject *lz, PyObject *Py_UNUSED(ignored)) PyDoc_STRVAR(setstate_doc, "Set state information for unpickling."); static PyObject * -map_setstate(mapobject *lz, PyObject *state) +map_setstate(PyObject *self, PyObject *state) { int strict = PyObject_IsTrue(state); if (strict < 0) { return NULL; } + mapobject *lz = _mapobject_CAST(self); lz->strict = strict; Py_RETURN_NONE; } static PyMethodDef map_methods[] = { - {"__reduce__", _PyCFunction_CAST(map_reduce), METH_NOARGS, reduce_doc}, - {"__setstate__", _PyCFunction_CAST(map_setstate), METH_O, setstate_doc}, + {"__reduce__", map_reduce, METH_NOARGS, reduce_doc}, + {"__setstate__", map_setstate, METH_O, setstate_doc}, {NULL, NULL} /* sentinel */ }; @@ -1578,7 +1591,7 @@ PyTypeObject PyMap_Type = { sizeof(mapobject), /* tp_basicsize */ 0, /* tp_itemsize */ /* methods */ - (destructor)map_dealloc, /* tp_dealloc */ + map_dealloc, /* tp_dealloc */ 0, /* tp_vectorcall_offset */ 0, /* tp_getattr */ 0, /* tp_setattr */ @@ -1596,12 +1609,12 @@ PyTypeObject PyMap_Type = { Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC | Py_TPFLAGS_BASETYPE, /* tp_flags */ map_doc, /* tp_doc */ - (traverseproc)map_traverse, /* tp_traverse */ + map_traverse, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ PyObject_SelfIter, /* tp_iter */ - (iternextfunc)map_next, /* tp_iternext */ + map_next, /* tp_iternext */ map_methods, /* tp_methods */ 0, /* tp_members */ 0, /* tp_getset */ @@ -1614,7 +1627,7 @@ PyTypeObject PyMap_Type = { PyType_GenericAlloc, /* tp_alloc */ map_new, /* tp_new */ PyObject_GC_Del, /* tp_free */ - .tp_vectorcall = (vectorcallfunc)map_vectorcall + .tp_vectorcall = map_vectorcall }; @@ -2965,6 +2978,8 @@ typedef struct { int strict; } zipobject; +#define _zipobject_CAST(op) ((zipobject *)(op)) + static PyObject * zip_new(PyTypeObject *type, PyObject *args, PyObject *kwds) { @@ -3033,8 +3048,9 @@ zip_new(PyTypeObject *type, PyObject *args, PyObject *kwds) } static void -zip_dealloc(zipobject *lz) +zip_dealloc(PyObject *self) { + zipobject *lz = _zipobject_CAST(self); PyObject_GC_UnTrack(lz); Py_XDECREF(lz->ittuple); Py_XDECREF(lz->result); @@ -3042,16 +3058,19 @@ zip_dealloc(zipobject *lz) } static int -zip_traverse(zipobject *lz, visitproc visit, void *arg) +zip_traverse(PyObject *self, visitproc visit, void *arg) { + zipobject *lz = _zipobject_CAST(self); Py_VISIT(lz->ittuple); Py_VISIT(lz->result); return 0; } static PyObject * -zip_next(zipobject *lz) +zip_next(PyObject *self) { + zipobject *lz = _zipobject_CAST(self); + Py_ssize_t i; Py_ssize_t tuplesize = lz->tuplesize; PyObject *result = lz->result; @@ -3141,8 +3160,9 @@ zip_next(zipobject *lz) } static PyObject * -zip_reduce(zipobject *lz, PyObject *Py_UNUSED(ignored)) +zip_reduce(PyObject *self, PyObject *Py_UNUSED(ignored)) { + zipobject *lz = _zipobject_CAST(self); /* Just recreate the zip with the internal iterator tuple */ if (lz->strict) { return PyTuple_Pack(3, Py_TYPE(lz), lz->ittuple, Py_True); @@ -3151,19 +3171,20 @@ zip_reduce(zipobject *lz, PyObject *Py_UNUSED(ignored)) } static PyObject * -zip_setstate(zipobject *lz, PyObject *state) +zip_setstate(PyObject *self, PyObject *state) { int strict = PyObject_IsTrue(state); if (strict < 0) { return NULL; } + zipobject *lz = _zipobject_CAST(self); lz->strict = strict; Py_RETURN_NONE; } static PyMethodDef zip_methods[] = { - {"__reduce__", _PyCFunction_CAST(zip_reduce), METH_NOARGS, reduce_doc}, - {"__setstate__", _PyCFunction_CAST(zip_setstate), METH_O, setstate_doc}, + {"__reduce__", zip_reduce, METH_NOARGS, reduce_doc}, + {"__setstate__", zip_setstate, METH_O, setstate_doc}, {NULL} /* sentinel */ }; @@ -3188,7 +3209,7 @@ PyTypeObject PyZip_Type = { sizeof(zipobject), /* tp_basicsize */ 0, /* tp_itemsize */ /* methods */ - (destructor)zip_dealloc, /* tp_dealloc */ + zip_dealloc, /* tp_dealloc */ 0, /* tp_vectorcall_offset */ 0, /* tp_getattr */ 0, /* tp_setattr */ @@ -3206,12 +3227,12 @@ PyTypeObject PyZip_Type = { Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC | Py_TPFLAGS_BASETYPE, /* tp_flags */ zip_doc, /* tp_doc */ - (traverseproc)zip_traverse, /* tp_traverse */ + zip_traverse, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ PyObject_SelfIter, /* tp_iter */ - (iternextfunc)zip_next, /* tp_iternext */ + zip_next, /* tp_iternext */ zip_methods, /* tp_methods */ 0, /* tp_members */ 0, /* tp_getset */

1 0

gh-111178: fix UBSan failures in `Objects/bytearrayobject.c` (GH-128236)
by encukou Jan. 10, 2025

Jan. 10, 2025

https://github.com/python/cpython/commit/613240bf03a44323f78f02359b2acf928a… commit: 613240bf03a44323f78f02359b2acf928a4093f4 branch: main author: Bénédikt Tran <10796600+picnixz(a)users.noreply.github.com> committer: encukou <encukou(a)gmail.com> date: 2025-01-10T11:50:02+01:00 summary: gh-111178: fix UBSan failures in `Objects/bytearrayobject.c` (GH-128236) * fix UBSan failures for `bytesiterobject` * fix UBSan failures for `PyByteArrayObject` files: M Objects/bytearrayobject.c diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c index 871f99b6f885ba..21584332e0e443 100644 --- a/Objects/bytearrayobject.c +++ b/Objects/bytearrayobject.c @@ -2113,8 +2113,9 @@ PyDoc_STRVAR(alloc_doc, Return the number of bytes actually allocated."); static PyObject * -bytearray_alloc(PyByteArrayObject *self, PyObject *Py_UNUSED(ignored)) +bytearray_alloc(PyObject *op, PyObject *Py_UNUSED(ignored)) { + PyByteArrayObject *self = _PyByteArray_CAST(op); return PyLong_FromSsize_t(self->ob_alloc); } @@ -2313,7 +2314,7 @@ static PyBufferProcs bytearray_as_buffer = { }; static PyMethodDef bytearray_methods[] = { - {"__alloc__", (PyCFunction)bytearray_alloc, METH_NOARGS, alloc_doc}, + {"__alloc__", bytearray_alloc, METH_NOARGS, alloc_doc}, BYTEARRAY_REDUCE_METHODDEF BYTEARRAY_REDUCE_EX_METHODDEF BYTEARRAY_SIZEOF_METHODDEF @@ -2464,24 +2465,29 @@ typedef struct { PyByteArrayObject *it_seq; /* Set to NULL when iterator is exhausted */ } bytesiterobject; +#define _bytesiterobject_CAST(op) ((bytesiterobject *)(op)) + static void -bytearrayiter_dealloc(bytesiterobject *it) +bytearrayiter_dealloc(PyObject *self) { + bytesiterobject *it = _bytesiterobject_CAST(self); _PyObject_GC_UNTRACK(it); Py_XDECREF(it->it_seq); PyObject_GC_Del(it); } static int -bytearrayiter_traverse(bytesiterobject *it, visitproc visit, void *arg) +bytearrayiter_traverse(PyObject *self, visitproc visit, void *arg) { + bytesiterobject *it = _bytesiterobject_CAST(self); Py_VISIT(it->it_seq); return 0; } static PyObject * -bytearrayiter_next(bytesiterobject *it) +bytearrayiter_next(PyObject *self) { + bytesiterobject *it = _bytesiterobject_CAST(self); PyByteArrayObject *seq; assert(it != NULL); @@ -2501,8 +2507,9 @@ bytearrayiter_next(bytesiterobject *it) } static PyObject * -bytearrayiter_length_hint(bytesiterobject *it, PyObject *Py_UNUSED(ignored)) +bytearrayiter_length_hint(PyObject *self, PyObject *Py_UNUSED(ignored)) { + bytesiterobject *it = _bytesiterobject_CAST(self); Py_ssize_t len = 0; if (it->it_seq) { len = PyByteArray_GET_SIZE(it->it_seq) - it->it_index; @@ -2517,14 +2524,14 @@ PyDoc_STRVAR(length_hint_doc, "Private method returning an estimate of len(list(it))."); static PyObject * -bytearrayiter_reduce(bytesiterobject *it, PyObject *Py_UNUSED(ignored)) +bytearrayiter_reduce(PyObject *self, PyObject *Py_UNUSED(ignored)) { PyObject *iter = _PyEval_GetBuiltin(&_Py_ID(iter)); /* _PyEval_GetBuiltin can invoke arbitrary code, * call must be before access of iterator pointers. * see issue #101765 */ - + bytesiterobject *it = _bytesiterobject_CAST(self); if (it->it_seq != NULL) { return Py_BuildValue("N(O)n", iter, it->it_seq, it->it_index); } else { @@ -2533,11 +2540,13 @@ bytearrayiter_reduce(bytesiterobject *it, PyObject *Py_UNUSED(ignored)) } static PyObject * -bytearrayiter_setstate(bytesiterobject *it, PyObject *state) +bytearrayiter_setstate(PyObject *self, PyObject *state) { Py_ssize_t index = PyLong_AsSsize_t(state); if (index == -1 && PyErr_Occurred()) return NULL; + + bytesiterobject *it = _bytesiterobject_CAST(self); if (it->it_seq != NULL) { if (index < 0) index = 0; @@ -2551,11 +2560,11 @@ bytearrayiter_setstate(bytesiterobject *it, PyObject *state) PyDoc_STRVAR(setstate_doc, "Set state information for unpickling."); static PyMethodDef bytearrayiter_methods[] = { - {"__length_hint__", (PyCFunction)bytearrayiter_length_hint, METH_NOARGS, + {"__length_hint__", bytearrayiter_length_hint, METH_NOARGS, length_hint_doc}, - {"__reduce__", (PyCFunction)bytearrayiter_reduce, METH_NOARGS, + {"__reduce__", bytearrayiter_reduce, METH_NOARGS, bytearray_reduce__doc__}, - {"__setstate__", (PyCFunction)bytearrayiter_setstate, METH_O, + {"__setstate__", bytearrayiter_setstate, METH_O, setstate_doc}, {NULL, NULL} /* sentinel */ }; @@ -2566,7 +2575,7 @@ PyTypeObject PyByteArrayIter_Type = { sizeof(bytesiterobject), /* tp_basicsize */ 0, /* tp_itemsize */ /* methods */ - (destructor)bytearrayiter_dealloc, /* tp_dealloc */ + bytearrayiter_dealloc, /* tp_dealloc */ 0, /* tp_vectorcall_offset */ 0, /* tp_getattr */ 0, /* tp_setattr */ @@ -2583,12 +2592,12 @@ PyTypeObject PyByteArrayIter_Type = { 0, /* tp_as_buffer */ Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC, /* tp_flags */ 0, /* tp_doc */ - (traverseproc)bytearrayiter_traverse, /* tp_traverse */ + bytearrayiter_traverse, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ PyObject_SelfIter, /* tp_iter */ - (iternextfunc)bytearrayiter_next, /* tp_iternext */ + bytearrayiter_next, /* tp_iternext */ bytearrayiter_methods, /* tp_methods */ 0, };

1 0

gh-111178: fix UBSan failures in `Objects/bytesobject.c` (GH-128237)
by encukou Jan. 10, 2025

Jan. 10, 2025

https://github.com/python/cpython/commit/295776c7f3778756e4bdbfa06bded731ad… commit: 295776c7f3778756e4bdbfa06bded731ad022047 branch: main author: Bénédikt Tran <10796600+picnixz(a)users.noreply.github.com> committer: encukou <encukou(a)gmail.com> date: 2025-01-10T11:48:06+01:00 summary: gh-111178: fix UBSan failures in `Objects/bytesobject.c` (GH-128237) * remove redundant casts for `bytesobject` * fix UBSan failures for `striterobject` files: M Objects/bytesobject.c diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c index 90e8a9af88b4a3..024653546563e6 100644 --- a/Objects/bytesobject.c +++ b/Objects/bytesobject.c @@ -3085,7 +3085,7 @@ PyTypeObject PyBytes_Type = { bytes_doc, /* tp_doc */ 0, /* tp_traverse */ 0, /* tp_clear */ - (richcmpfunc)bytes_richcompare, /* tp_richcompare */ + bytes_richcompare, /* tp_richcompare */ 0, /* tp_weaklistoffset */ bytes_iter, /* tp_iter */ 0, /* tp_iternext */ @@ -3245,24 +3245,29 @@ typedef struct { PyBytesObject *it_seq; /* Set to NULL when iterator is exhausted */ } striterobject; +#define _striterobject_CAST(op) ((striterobject *)(op)) + static void -striter_dealloc(striterobject *it) +striter_dealloc(PyObject *op) { + striterobject *it = _striterobject_CAST(op); _PyObject_GC_UNTRACK(it); Py_XDECREF(it->it_seq); PyObject_GC_Del(it); } static int -striter_traverse(striterobject *it, visitproc visit, void *arg) +striter_traverse(PyObject *op, visitproc visit, void *arg) { + striterobject *it = _striterobject_CAST(op); Py_VISIT(it->it_seq); return 0; } static PyObject * -striter_next(striterobject *it) +striter_next(PyObject *op) { + striterobject *it = _striterobject_CAST(op); PyBytesObject *seq; assert(it != NULL); @@ -3282,8 +3287,9 @@ striter_next(striterobject *it) } static PyObject * -striter_len(striterobject *it, PyObject *Py_UNUSED(ignored)) +striter_len(PyObject *op, PyObject *Py_UNUSED(ignored)) { + striterobject *it = _striterobject_CAST(op); Py_ssize_t len = 0; if (it->it_seq) len = PyBytes_GET_SIZE(it->it_seq) - it->it_index; @@ -3294,14 +3300,14 @@ PyDoc_STRVAR(length_hint_doc, "Private method returning an estimate of len(list(it))."); static PyObject * -striter_reduce(striterobject *it, PyObject *Py_UNUSED(ignored)) +striter_reduce(PyObject *op, PyObject *Py_UNUSED(ignored)) { PyObject *iter = _PyEval_GetBuiltin(&_Py_ID(iter)); /* _PyEval_GetBuiltin can invoke arbitrary code, * call must be before access of iterator pointers. * see issue #101765 */ - + striterobject *it = _striterobject_CAST(op); if (it->it_seq != NULL) { return Py_BuildValue("N(O)n", iter, it->it_seq, it->it_index); } else { @@ -3312,11 +3318,12 @@ striter_reduce(striterobject *it, PyObject *Py_UNUSED(ignored)) PyDoc_STRVAR(reduce_doc, "Return state information for pickling."); static PyObject * -striter_setstate(striterobject *it, PyObject *state) +striter_setstate(PyObject *op, PyObject *state) { Py_ssize_t index = PyLong_AsSsize_t(state); if (index == -1 && PyErr_Occurred()) return NULL; + striterobject *it = _striterobject_CAST(op); if (it->it_seq != NULL) { if (index < 0) index = 0; @@ -3330,12 +3337,9 @@ striter_setstate(striterobject *it, PyObject *state) PyDoc_STRVAR(setstate_doc, "Set state information for unpickling."); static PyMethodDef striter_methods[] = { - {"__length_hint__", (PyCFunction)striter_len, METH_NOARGS, - length_hint_doc}, - {"__reduce__", (PyCFunction)striter_reduce, METH_NOARGS, - reduce_doc}, - {"__setstate__", (PyCFunction)striter_setstate, METH_O, - setstate_doc}, + {"__length_hint__", striter_len, METH_NOARGS, length_hint_doc}, + {"__reduce__", striter_reduce, METH_NOARGS, reduce_doc}, + {"__setstate__", striter_setstate, METH_O, setstate_doc}, {NULL, NULL} /* sentinel */ }; @@ -3345,7 +3349,7 @@ PyTypeObject PyBytesIter_Type = { sizeof(striterobject), /* tp_basicsize */ 0, /* tp_itemsize */ /* methods */ - (destructor)striter_dealloc, /* tp_dealloc */ + striter_dealloc, /* tp_dealloc */ 0, /* tp_vectorcall_offset */ 0, /* tp_getattr */ 0, /* tp_setattr */ @@ -3362,12 +3366,12 @@ PyTypeObject PyBytesIter_Type = { 0, /* tp_as_buffer */ Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC,/* tp_flags */ 0, /* tp_doc */ - (traverseproc)striter_traverse, /* tp_traverse */ + striter_traverse, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ PyObject_SelfIter, /* tp_iter */ - (iternextfunc)striter_next, /* tp_iternext */ + striter_next, /* tp_iternext */ striter_methods, /* tp_methods */ 0, };

1 0

gh-111178: fix UBSan failures in `Modules/_bz2module.c` (GH-128238)
by encukou Jan. 10, 2025

Jan. 10, 2025

https://github.com/python/cpython/commit/49d78158c058ff2dece8c0a1acec384f9c… commit: 49d78158c058ff2dece8c0a1acec384f9c413ab3 branch: main author: Bénédikt Tran <10796600+picnixz(a)users.noreply.github.com> committer: encukou <encukou(a)gmail.com> date: 2025-01-10T11:47:19+01:00 summary: gh-111178: fix UBSan failures in `Modules/_bz2module.c` (GH-128238) files: M Modules/_bz2module.c diff --git a/Modules/_bz2module.c b/Modules/_bz2module.c index 661847ad26702e..9e85e0de42cd8d 100644 --- a/Modules/_bz2module.c +++ b/Modules/_bz2module.c @@ -129,6 +129,9 @@ typedef struct { PyThread_type_lock lock; } BZ2Decompressor; +#define _BZ2Compressor_CAST(op) ((BZ2Compressor *)(op)) +#define _BZ2Decompressor_CAST(op) ((BZ2Decompressor *)(op)) + /* Helper functions. */ static int @@ -376,8 +379,9 @@ _bz2_BZ2Compressor_impl(PyTypeObject *type, int compresslevel) } static void -BZ2Compressor_dealloc(BZ2Compressor *self) +BZ2Compressor_dealloc(PyObject *op) { + BZ2Compressor *self = _BZ2Compressor_CAST(op); BZ2_bzCompressEnd(&self->bzs); if (self->lock != NULL) { PyThread_free_lock(self->lock); @@ -388,7 +392,7 @@ BZ2Compressor_dealloc(BZ2Compressor *self) } static int -BZ2Compressor_traverse(BZ2Compressor *self, visitproc visit, void *arg) +BZ2Compressor_traverse(PyObject *self, visitproc visit, void *arg) { Py_VISIT(Py_TYPE(self)); return 0; @@ -680,8 +684,10 @@ _bz2_BZ2Decompressor_impl(PyTypeObject *type) } static void -BZ2Decompressor_dealloc(BZ2Decompressor *self) +BZ2Decompressor_dealloc(PyObject *op) { + BZ2Decompressor *self = _BZ2Decompressor_CAST(op); + if(self->input_buffer != NULL) { PyMem_Free(self->input_buffer); } @@ -697,7 +703,7 @@ BZ2Decompressor_dealloc(BZ2Decompressor *self) } static int -BZ2Decompressor_traverse(BZ2Decompressor *self, visitproc visit, void *arg) +BZ2Decompressor_traverse(PyObject *self, visitproc visit, void *arg) { Py_VISIT(Py_TYPE(self)); return 0;

1 0

gh-111178: fix UBSan failures in `Objects/complexobject.c` (GH-128241)
by encukou Jan. 10, 2025

Jan. 10, 2025

https://github.com/python/cpython/commit/6cf31750e0eba0b0e70ac10bf0dfa3db26… commit: 6cf31750e0eba0b0e70ac10bf0dfa3db268a4dbd branch: main author: Bénédikt Tran <10796600+picnixz(a)users.noreply.github.com> committer: encukou <encukou(a)gmail.com> date: 2025-01-10T10:46:36Z summary: gh-111178: fix UBSan failures in `Objects/complexobject.c` (GH-128241) fix UBSan failures for `PyComplexObject` files: M Objects/complexobject.c diff --git a/Objects/complexobject.c b/Objects/complexobject.c index bf6187efac941f..5d9b3c9f0e3e76 100644 --- a/Objects/complexobject.c +++ b/Objects/complexobject.c @@ -14,6 +14,8 @@ #include "pycore_pymath.h" // _Py_ADJUST_ERANGE2() +#define _PyComplexObject_CAST(op) ((PyComplexObject *)(op)) + /*[clinic input] class complex "PyComplexObject *" "&PyComplex_Type" @@ -553,11 +555,12 @@ PyComplex_AsCComplex(PyObject *op) } static PyObject * -complex_repr(PyComplexObject *v) +complex_repr(PyObject *op) { int precision = 0; char format_code = 'r'; PyObject *result = NULL; + PyComplexObject *v = _PyComplexObject_CAST(op); /* If these are non-NULL, they'll need to be freed. */ char *pre = NULL; @@ -609,13 +612,14 @@ complex_repr(PyComplexObject *v) } static Py_hash_t -complex_hash(PyComplexObject *v) +complex_hash(PyObject *op) { Py_uhash_t hashreal, hashimag, combined; - hashreal = (Py_uhash_t)_Py_HashDouble((PyObject *) v, v->cval.real); + PyComplexObject *v = _PyComplexObject_CAST(op); + hashreal = (Py_uhash_t)_Py_HashDouble(op, v->cval.real); if (hashreal == (Py_uhash_t)-1) return -1; - hashimag = (Py_uhash_t)_Py_HashDouble((PyObject *)v, v->cval.imag); + hashimag = (Py_uhash_t)_Py_HashDouble(op, v->cval.imag); if (hashimag == (Py_uhash_t)-1) return -1; /* Note: if the imaginary part is 0, hashimag is 0 now, @@ -753,8 +757,9 @@ complex_pow(PyObject *v, PyObject *w, PyObject *z) } static PyObject * -complex_neg(PyComplexObject *v) +complex_neg(PyObject *op) { + PyComplexObject *v = _PyComplexObject_CAST(op); Py_complex neg; neg.real = -v->cval.real; neg.imag = -v->cval.imag; @@ -762,22 +767,20 @@ complex_neg(PyComplexObject *v) } static PyObject * -complex_pos(PyComplexObject *v) +complex_pos(PyObject *op) { + PyComplexObject *v = _PyComplexObject_CAST(op); if (PyComplex_CheckExact(v)) { return Py_NewRef(v); } - else - return PyComplex_FromCComplex(v->cval); + return PyComplex_FromCComplex(v->cval); } static PyObject * -complex_abs(PyComplexObject *v) +complex_abs(PyObject *op) { - double result; - - result = _Py_c_abs(v->cval); - + PyComplexObject *v = _PyComplexObject_CAST(op); + double result = _Py_c_abs(v->cval); if (errno == ERANGE) { PyErr_SetString(PyExc_OverflowError, "absolute value too large"); @@ -787,8 +790,9 @@ complex_abs(PyComplexObject *v) } static int -complex_bool(PyComplexObject *v) +complex_bool(PyObject *op) { + PyComplexObject *v = _PyComplexObject_CAST(op); return v->cval.real != 0.0 || v->cval.imag != 0.0; } @@ -1339,16 +1343,16 @@ static PyMemberDef complex_members[] = { }; static PyNumberMethods complex_as_number = { - (binaryfunc)complex_add, /* nb_add */ - (binaryfunc)complex_sub, /* nb_subtract */ - (binaryfunc)complex_mul, /* nb_multiply */ + complex_add, /* nb_add */ + complex_sub, /* nb_subtract */ + complex_mul, /* nb_multiply */ 0, /* nb_remainder */ 0, /* nb_divmod */ - (ternaryfunc)complex_pow, /* nb_power */ - (unaryfunc)complex_neg, /* nb_negative */ - (unaryfunc)complex_pos, /* nb_positive */ - (unaryfunc)complex_abs, /* nb_absolute */ - (inquiry)complex_bool, /* nb_bool */ + complex_pow, /* nb_power */ + complex_neg, /* nb_negative */ + complex_pos, /* nb_positive */ + complex_abs, /* nb_absolute */ + complex_bool, /* nb_bool */ 0, /* nb_invert */ 0, /* nb_lshift */ 0, /* nb_rshift */ @@ -1369,7 +1373,7 @@ static PyNumberMethods complex_as_number = { 0, /* nb_inplace_xor */ 0, /* nb_inplace_or */ 0, /* nb_floor_divide */ - (binaryfunc)complex_div, /* nb_true_divide */ + complex_div, /* nb_true_divide */ 0, /* nb_inplace_floor_divide */ 0, /* nb_inplace_true_divide */ }; @@ -1384,11 +1388,11 @@ PyTypeObject PyComplex_Type = { 0, /* tp_getattr */ 0, /* tp_setattr */ 0, /* tp_as_async */ - (reprfunc)complex_repr, /* tp_repr */ + complex_repr, /* tp_repr */ &complex_as_number, /* tp_as_number */ 0, /* tp_as_sequence */ 0, /* tp_as_mapping */ - (hashfunc)complex_hash, /* tp_hash */ + complex_hash, /* tp_hash */ 0, /* tp_call */ 0, /* tp_str */ PyObject_GenericGetAttr, /* tp_getattro */

1 0

gh-128694: Fix `(env changed)` error in `test_inspect` (#128702)
by sobolevn Jan. 10, 2025

Jan. 10, 2025

https://github.com/python/cpython/commit/65b484db97b170af0f0e50655c4dcc6b9b… commit: 65b484db97b170af0f0e50655c4dcc6b9b1af8e9 branch: main author: sobolevn <mail(a)sobolevn.me> committer: sobolevn <mail(a)sobolevn.me> date: 2025-01-10T13:25:02+03:00 summary: gh-128694: Fix `(env changed)` error in `test_inspect` (#128702) files: M Lib/test/test_inspect/test_inspect.py diff --git a/Lib/test/test_inspect/test_inspect.py b/Lib/test/test_inspect/test_inspect.py index 345a57a5cfee2d..6457bc523de460 100644 --- a/Lib/test/test_inspect/test_inspect.py +++ b/Lib/test/test_inspect/test_inspect.py @@ -1,4 +1,5 @@ from annotationlib import Format, ForwardRef +import asyncio import builtins import collections import copy @@ -2791,6 +2792,10 @@ async def number_asyncgen(): async def asyncTearDown(self): await self.asyncgen.aclose() + @classmethod + def tearDownClass(cls): + asyncio._set_event_loop_policy(None) + def _asyncgenstate(self): return inspect.getasyncgenstate(self.asyncgen)

1 0

[3.13] gh-118915: Document `PyUnstable_InterpreterState_GetMainModule` (GH-128483) (GH-128677)
by encukou Jan. 10, 2025

Jan. 10, 2025

https://github.com/python/cpython/commit/65da5db28a39cb0d9ee311206bdc8745b4… commit: 65da5db28a39cb0d9ee311206bdc8745b482c56f branch: 3.13 author: Miss Islington (bot) <31488909+miss-islington(a)users.noreply.github.com> committer: encukou <encukou(a)gmail.com> date: 2025-01-10T08:41:14+01:00 summary: [3.13] gh-118915: Document `PyUnstable_InterpreterState_GetMainModule` (GH-128483) (GH-128677) (cherry picked from commit ea39c8b08d8f025273bfa5b7a95f7b5984dc1e86) Co-authored-by: Peter Bierma <zintensitydev(a)gmail.com> files: M Doc/c-api/init.rst diff --git a/Doc/c-api/init.rst b/Doc/c-api/init.rst index d0632cb6fa172f..130942e070ef7a 100644 --- a/Doc/c-api/init.rst +++ b/Doc/c-api/init.rst @@ -1445,6 +1445,17 @@ All of the following functions must be called after :c:func:`Py_Initialize`. .. versionadded:: 3.8 + +.. c:function:: PyObject* PyUnstable_InterpreterState_GetMainModule(PyInterpreterState *interp) + + Return a :term:`strong reference` to the ``__main__`` `module object <moduleobjects>`_ + for the given interpreter. + + The caller must hold the GIL. + + .. versionadded:: 3.13 + + .. c:type:: PyObject* (*_PyFrameEvalFunction)(PyThreadState *tstate, _PyInterpreterFrame *frame, int throwflag) Type of a frame evaluation function.

1 0

[3.13] gh-126862: Use `Py_ssize_t` instead of `int` when processing the number of super-classes (GH-127523) (#128699)
by JelleZijlstra Jan. 10, 2025

Jan. 10, 2025

https://github.com/python/cpython/commit/5370ad100d1801925a1e037314289c3bd4… commit: 5370ad100d1801925a1e037314289c3bd433a4e5 branch: 3.13 author: Miss Islington (bot) <31488909+miss-islington(a)users.noreply.github.com> committer: JelleZijlstra <jelle.zijlstra(a)gmail.com> date: 2025-01-10T03:56:35Z summary: [3.13] gh-126862: Use `Py_ssize_t` instead of `int` when processing the number of super-classes (GH-127523) (#128699) gh-126862: Use `Py_ssize_t` instead of `int` when processing the number of super-classes (GH-127523) (cherry picked from commit 2fcdc8488c32d18f4567f797094068a994777f16) Co-authored-by: Bénédikt Tran <10796600+picnixz(a)users.noreply.github.com> files: A Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst M Objects/typeobject.c diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst b/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst new file mode 100644 index 00000000000000..d930c2963e3632 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst @@ -0,0 +1,2 @@ +Fix a possible overflow when a class inherits from an absurd number of +super-classes. Reported by Valery Fedorenko. Patch by Bénédikt Tran. diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 20b99816593cbe..093ebac9b50179 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -2649,7 +2649,7 @@ vectorcall_maybe(PyThreadState *tstate, PyObject *name, */ static int -tail_contains(PyObject *tuple, int whence, PyObject *o) +tail_contains(PyObject *tuple, Py_ssize_t whence, PyObject *o) { Py_ssize_t j, size; size = PyTuple_GET_SIZE(tuple); @@ -2712,7 +2712,7 @@ check_duplicates(PyObject *tuple) */ static void -set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, int *remain) +set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, Py_ssize_t *remain) { Py_ssize_t i, n, off; char buf[1000]; @@ -2767,13 +2767,13 @@ pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size) { int res = 0; Py_ssize_t i, j, empty_cnt; - int *remain; + Py_ssize_t *remain; /* remain stores an index into each sublist of to_merge. remain[i] is the index of the next base in to_merge[i] that is not included in acc. */ - remain = PyMem_New(int, to_merge_size); + remain = PyMem_New(Py_ssize_t, to_merge_size); if (remain == NULL) { PyErr_NoMemory(); return -1;

1 0

[3.12] gh-126862: Use `Py_ssize_t` instead of `int` when processing the number of super-classes (GH-127523) (#128700)
by JelleZijlstra Jan. 10, 2025

Jan. 10, 2025

https://github.com/python/cpython/commit/b55c40419e3bdf325ed5ebc73e9473dab3… commit: b55c40419e3bdf325ed5ebc73e9473dab3eaf090 branch: 3.12 author: Miss Islington (bot) <31488909+miss-islington(a)users.noreply.github.com> committer: JelleZijlstra <jelle.zijlstra(a)gmail.com> date: 2025-01-10T03:51:45Z summary: [3.12] gh-126862: Use `Py_ssize_t` instead of `int` when processing the number of super-classes (GH-127523) (#128700) gh-126862: Use `Py_ssize_t` instead of `int` when processing the number of super-classes (GH-127523) (cherry picked from commit 2fcdc8488c32d18f4567f797094068a994777f16) Co-authored-by: Bénédikt Tran <10796600+picnixz(a)users.noreply.github.com> files: A Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst M Objects/typeobject.c diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst b/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst new file mode 100644 index 00000000000000..d930c2963e3632 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst @@ -0,0 +1,2 @@ +Fix a possible overflow when a class inherits from an absurd number of +super-classes. Reported by Valery Fedorenko. Patch by Bénédikt Tran. diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 06857e3685740a..b0c79d34e6525b 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -2319,7 +2319,7 @@ vectorcall_maybe(PyThreadState *tstate, PyObject *name, */ static int -tail_contains(PyObject *tuple, int whence, PyObject *o) +tail_contains(PyObject *tuple, Py_ssize_t whence, PyObject *o) { Py_ssize_t j, size; size = PyTuple_GET_SIZE(tuple); @@ -2382,7 +2382,7 @@ check_duplicates(PyObject *tuple) */ static void -set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, int *remain) +set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, Py_ssize_t *remain) { Py_ssize_t i, n, off; char buf[1000]; @@ -2437,13 +2437,13 @@ pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size) { int res = 0; Py_ssize_t i, j, empty_cnt; - int *remain; + Py_ssize_t *remain; /* remain stores an index into each sublist of to_merge. remain[i] is the index of the next base in to_merge[i] that is not included in acc. */ - remain = PyMem_New(int, to_merge_size); + remain = PyMem_New(Py_ssize_t, to_merge_size); if (remain == NULL) { PyErr_NoMemory(); return -1;

1 0

gh-126862: Use `Py_ssize_t` instead of `int` when processing the number of super-classes (#127523)
by JelleZijlstra Jan. 10, 2025

Jan. 10, 2025

https://github.com/python/cpython/commit/2fcdc8488c32d18f4567f797094068a994… commit: 2fcdc8488c32d18f4567f797094068a994777f16 branch: main author: Bénédikt Tran <10796600+picnixz(a)users.noreply.github.com> committer: JelleZijlstra <jelle.zijlstra(a)gmail.com> date: 2025-01-10T03:32:53Z summary: gh-126862: Use `Py_ssize_t` instead of `int` when processing the number of super-classes (#127523) files: A Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst M Objects/typeobject.c diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst b/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst new file mode 100644 index 00000000000000..d930c2963e3632 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2024-12-02-18-15-37.gh-issue-126862.fdIK7T.rst @@ -0,0 +1,2 @@ +Fix a possible overflow when a class inherits from an absurd number of +super-classes. Reported by Valery Fedorenko. Patch by Bénédikt Tran. diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 7f95b519561e68..680846f1c0b865 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -2860,7 +2860,7 @@ vectorcall_maybe(PyThreadState *tstate, PyObject *name, */ static int -tail_contains(PyObject *tuple, int whence, PyObject *o) +tail_contains(PyObject *tuple, Py_ssize_t whence, PyObject *o) { Py_ssize_t j, size; size = PyTuple_GET_SIZE(tuple); @@ -2923,7 +2923,7 @@ check_duplicates(PyObject *tuple) */ static void -set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, int *remain) +set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, Py_ssize_t *remain) { Py_ssize_t i, n, off; char buf[1000]; @@ -2978,13 +2978,13 @@ pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size) { int res = 0; Py_ssize_t i, j, empty_cnt; - int *remain; + Py_ssize_t *remain; /* remain stores an index into each sublist of to_merge. remain[i] is the index of the next base in to_merge[i] that is not included in acc. */ - remain = PyMem_New(int, to_merge_size); + remain = PyMem_New(Py_ssize_t, to_merge_size); if (remain == NULL) { PyErr_NoMemory(); return -1;

1 0