Issue #18339: Negative ints keys in unpickler.memo dict no longer cause a

segfault inside the _pickle C extension.

diff --git a/Lib/test/test_pickle.py b/Lib/test/test_pickle.py
index f52d4bdee949e58b5245659cedf1e70c44ea0ad9..e96fe523df7547b68da083d8b4c8c13027b91773 100644 (file)
--- a/Lib/test/test_pickle.py
+++ b/Lib/test/test_pickle.py
@@ -115,6 +115,13 @@ if has_c_implementation:
         pickler_class = _pickle.Pickler
         unpickler_class = _pickle.Unpickler
 
+        def test_issue18339(self):
+            unpickler = self.unpickler_class(io.BytesIO())
+            self.assertRaises(TypeError, setattr, unpickler, "memo", object)
+            # used to cause a segfault
+            self.assertRaises(ValueError, setattr, unpickler, "memo", {-1: None})
+            unpickler.memo = {1: None}
+
     class CDispatchTableTests(AbstractDispatchTableTests):
         pickler_class = pickle.Pickler
         def get_dispatch_table(self):

diff --git a/Misc/NEWS b/Misc/NEWS
index e6539257596dcd46e8c10210b63f431c7f36ed61..37ee7fc79e7488b02c6214408b6a25ebb29f7998 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -38,6 +38,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #18339: Negative ints keys in unpickler.memo dict no longer cause a
+  segfault inside the _pickle C extension.
+
 - Issue #18224: Removed pydoc script from created venv, as it causes problems
   on Windows and adds no value over and above python -m pydoc ...
 

diff --git a/Modules/_pickle.c b/Modules/_pickle.c
index a8d6684b7cdbc8bf056e6ff5c8eb203a58248bdc..195ee5d7907929a00f1a4d2f118c61bd598f490c 100644 (file)
--- a/Modules/_pickle.c
+++ b/Modules/_pickle.c
@@ -5931,6 +5931,11 @@ Unpickler_set_memo(UnpicklerObject *self, PyObject *obj)
             idx = PyLong_AsSsize_t(key);
             if (idx == -1 && PyErr_Occurred())
                 goto error;
+            if (idx < 0) {
+                PyErr_SetString(PyExc_ValueError,
+                                "memos key must be positive integers.");
+                goto error;
+            }
             if (_Unpickler_MemoPut(self, idx, value) < 0)
                 goto error;
         }