https://github.com/python/cpython/commit/a6c3f6d34792c5f9dc296ce8329938b7b2b... commit: a6c3f6d34792c5f9dc296ce8329938b7b2b02ea9 branch: 3.10 author: Pablo Galindo Salgado <Pablogsal@gmail.com> committer: pablogsal <Pablogsal@gmail.com> date: 2022-08-23T15:58:25+01:00 summary: [3.10] GH-96187: Prevent _PyCode_GetExtra to return garbage for negative indexes (GH-96188). (#96210) (cherry picked from commit 16ebae4cd4029205d932751f26c719c6cb8a6e92) Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com> files: A Misc/NEWS.d/next/Core and Builtins/2022-08-22-21-33-28.gh-issue-96187.W_6SRG.rst M Objects/codeobject.c diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-08-22-21-33-28.gh-issue-96187.W_6SRG.rst b/Misc/NEWS.d/next/Core and Builtins/2022-08-22-21-33-28.gh-issue-96187.W_6SRG.rst new file mode 100644 index 000000000000..fd194faa6854 --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2022-08-22-21-33-28.gh-issue-96187.W_6SRG.rst @@ -0,0 +1,2 @@ +Fixed a bug that caused ``_PyCode_GetExtra`` to return garbage for negative +indexes. Patch by Pablo Galindo diff --git a/Objects/codeobject.c b/Objects/codeobject.c index 976cec584e9f..390b76cafd51 100644 --- a/Objects/codeobject.c +++ b/Objects/codeobject.c @@ -1304,7 +1304,7 @@ _PyCode_GetExtra(PyObject *code, Py_ssize_t index, void **extra) PyCodeObject *o = (PyCodeObject*) code; _PyCodeObjectExtra *co_extra = (_PyCodeObjectExtra*) o->co_extra; - if (co_extra == NULL || co_extra->ce_size <= index) { + if (co_extra == NULL || index < 0 || co_extra->ce_size <= index) { *extra = NULL; return 0; }