| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | [3.8] gh-95778: CVE-2020-10735: Prevent DoS by very large int() (#96503) | Gregory P. Smith | 2022-09-05 | 1 | -3/+8 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Correctly pre-check for int-to-str conversion Converting a large enough `int` to a decimal string raises `ValueError` as expected. However, the raise comes _after_ the quadratic-time base-conversion algorithm has run to completion. For effective DOS prevention, we need some kind of check before entering the quadratic-time loop. Oops! =) The quick fix: essentially we catch _most_ values that exceed the threshold up front. Those that slip through will still be on the small side (read: sufficiently fast), and will get caught by the existing check so that the limit remains exact. The justification for the current check. The C code check is: ```c max_str_digits / (3 * PyLong_SHIFT) <= (size_a - 11) / 10 ``` In GitHub markdown math-speak, writing $M$ for `max_str_digits`, $L$ for `PyLong_SHIFT` and $s$ for `size_a`, that check is: $$\left\lfloor\frac{M}{3L}\right\rfloor \le \left\lfloor\frac{s - 11}{10}\right\rfloor$$ From this it follows that $$\frac{M}{3L} < \frac{s-1}{10}$$ hence that $$\frac{L(s-1)}{M} > \frac{10}{3} > \log_2(10).$$ So $$2^{L(s-1)} > 10^M.$$ But our input integer $a$ satisfies $|a| \ge 2^{L(s-1)}$, so $|a|$ is larger than $10^M$. This shows that we don't accidentally capture anything _below_ the intended limit in the check. <!-- gh-issue-number: gh-95778 --> * Issue: gh-95778 <!-- /gh-issue-number --> Co-authored-by: Gregory P. Smith [Google LLC] <greg@krypto.org> Co-authored-by: Christian Heimes <christian@python.org> Co-authored-by: Mark Dickinson <dickinsm@gmail.com> | ||||
| * | bpo-33461: emit DeprecationWarning when json.loads(encoding=...) is used ↵ | Matthias Bussonnier | 2019-04-09 | 1 | -0/+4 |
| | | | | | (GH-6762) | ||||
| * | bpo-30877: Fix clearing a cache in the the JSON decoder. (GH-7048) | Serhiy Storchaka | 2018-05-22 | 1 | -1/+3 |
| | | |||||
| * | bpo-29919: Remove unused imports found by pyflakes (#137) | Victor Stinner | 2017-03-27 | 1 | -1/+1 |
| | | | | Make also minor PEP8 coding style fixes on modified imports. | ||||
| * | Issue #17909: Accept binary input in json.loads | Nick Coghlan | 2016-09-10 | 1 | -3/+1 |
| | | | | | | | | json.loads (and hence json.load) now support binary input encoded as UTF-8, UTF-16 or UTF-32. Patch by Serhiy Storchaka. | ||||
| * | Issue #27993: Fix problems with plural objects in docs and comments | Martin Panter | 2016-09-07 | 1 | -1/+1 |
| | | |||||
| * | Issue #19361: JSON decoder now raises JSONDecodeError instead of ValueError. | Serhiy Storchaka | 2015-01-26 | 1 | -4/+4 |
| | | |||||
| * | merge 3.3 | Benjamin Peterson | 2014-04-14 | 1 | -0/+4 |
| |\ | |||||
| | * | merge 3.2 | Benjamin Peterson | 2014-04-14 | 1 | -0/+4 |
| | | | |||||
| * | | #18958: Improve error message for json.load(s) while passing a string that ↵ | Ezio Melotti | 2013-10-20 | 1 | -0/+14 |
| | | | | | | | | | starts with a UTF-8 BOM. | ||||
| * | | #19307: Improve error message for json.load(s) while passing objects of the ↵ | Ezio Melotti | 2013-10-20 | 1 | -1/+8 |
| |/ | | | | wrong type. | ||||
| * | #18273: move the tests in Lib/test/json_tests to Lib/test/test_json and make ↵ | Ezio Melotti | 2013-08-08 | 1 | -0/+74 |
| them discoverable by unittest. Patch by Zachary Ware. | |||||
 |
index : cpython.git | |
| https://github.com/python/cpython.git |
| summaryrefslogtreecommitdiffstats |