From: Ammar Askar <ammar@ammaraskar.com>
Date: Wed, 17 Mar 2021 18:26:38 +0000 (-0400)
Subject: [3.9] bpo-43499: Restrict co_code to be under INT_MAX in codeobject (GH-20628) (GH... 
X-Git-Tag: v3.9.3~33
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=db733761060be92915b5f5cba209dcaada88f94e;p=thirdparty%2FPython%2Fcpython.git

[3.9] bpo-43499: Restrict co_code to be under INT_MAX in codeobject (GH-20628) (GH-24896)

(cherry picked from commit 3b3b83c965447a8329b34cb4befe6e9908880ee5)
---

diff --git a/Objects/codeobject.c b/Objects/codeobject.c
index 737635943ace..cb4fb6812433 100644
--- a/Objects/codeobject.c
+++ b/Objects/codeobject.c
@@ -166,6 +166,14 @@ PyCode_NewWithPosOnlyArgs(int argcount, int posonlyargcount, int kwonlyargcount,
         return NULL;
     }
 
+    /* Make sure that code is indexable with an int, this is
+       a long running assumption in ceval.c and many parts of
+       the interpreter. */
+    if (PyBytes_GET_SIZE(code) > INT_MAX) {
+        PyErr_SetString(PyExc_OverflowError, "co_code larger than INT_MAX");
+        return NULL;
+    }
+
     /* Check for any inner or outer closure references */
     n_cellvars = PyTuple_GET_SIZE(cellvars);
     if (!n_cellvars && !PyTuple_GET_SIZE(freevars)) {
diff --git a/Objects/frameobject.c b/Objects/frameobject.c
index a2fc0a423747..b511e4c832c7 100644
--- a/Objects/frameobject.c
+++ b/Objects/frameobject.c
@@ -397,7 +397,9 @@ frame_setlineno(PyFrameObject *f, PyObject* p_new_lineno, void *Py_UNUSED(ignore
         return -1;
     }
 
-    int len = PyBytes_GET_SIZE(f->f_code->co_code)/sizeof(_Py_CODEUNIT);
+    /* PyCode_NewWithPosOnlyArgs limits co_code to be under INT_MAX so this
+     * should never overflow. */
+    int len = (int)(PyBytes_GET_SIZE(f->f_code->co_code) / sizeof(_Py_CODEUNIT));
     int *lines = marklines(f->f_code, len);
     if (lines == NULL) {
         return -1;