Skip to content

gh-95185: Check recursion depth in the AST constructor #95186

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Jul 24, 2022
Merged

gh-95185: Check recursion depth in the AST constructor #95186

merged 3 commits into from
Jul 24, 2022

Conversation

pablogsal
Copy link
Member

@pablogsal pablogsal commented Jul 23, 2022 •
edited
Loading

@pablogsal pablogsal requested a review from isidentical as a code owner July 23, 2022 23:29
@pablogsal pablogsal added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Jul 23, 2022
@pablogsal pablogsal force-pushed the recursion branch 2 times, most recently from 95853f4 to 3057a67 Compare July 23, 2022 23:43
@pablogsal pablogsal added the needs backport to 3.9 only security fixes label Jul 23, 2022
@graingert
Copy link
Contributor

A similar issue didn't get backported to 3.9 #25634

@pablogsal pablogsal removed the needs backport to 3.9 only security fixes label Jul 24, 2022
@pablogsal
Copy link
Member Author

A similar issue didn't get backported to 3.9 #25634

We may need to discuss this (check PSRT @ambv)

isidentical
isidentical reviewed Jul 24, 2022
View reviewed changes
serhiy-storchaka
serhiy-storchaka reviewed Jul 24, 2022
View reviewed changes
Copy link
Member

@serhiy-storchaka serhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the code is generated and functions only have one exit on failure, you can add state->recursion_depth-- also for failure, and check the balance on failure too, as in symtable, etc.

I did not decremented the recursion depth on failure in ast_opt because functions there have multiple failure exits, so it would complicate the code. But in this case it will complicate the code.

serhiy-storchaka
serhiy-storchaka approved these changes Jul 24, 2022
View reviewed changes
Copy link
Member

@serhiy-storchaka serhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In any case LGTM.

pablogsal and others added 2 commits July 24, 2022 13:34
@pablogsal @serhiy-storchaka
Update Parser/asdl_c.py
a11956d 
Co-authored-by: Serhiy Storchaka <[email protected]>
@pablogsal @serhiy-storchaka
Update Parser/asdl_c.py
853fda6 
Co-authored-by: Serhiy Storchaka <[email protected]>
Signed-off-by: Pablo Galindo <[email protected]>
@pablogsal pablogsal merged commit 0047447 into python:main Jul 24, 2022
@pablogsal pablogsal deleted the recursion branch July 24, 2022 14:58
@miss-islington
Copy link
Contributor

Thanks @pablogsal for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jul 24, 2022
@pablogsal @miss-islington
pythongh-95185: Check recursion depth in the AST constructor (pythonG…
8794d47 
…H-95186)

Co-authored-by: Serhiy Storchaka <[email protected]>
(cherry picked from commit 0047447)

Co-authored-by: Pablo Galindo Salgado <[email protected]>
@bedevere-bot bedevere-bot removed the needs backport to 3.11 only security fixes label Jul 24, 2022
@bedevere-bot
Copy link

GH-95208 is a backport of this pull request to the 3.11 branch.

@miss-islington
Copy link
Contributor

Sorry, @pablogsal, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 00474472944944b346d8409cfded84bb299f601a 3.10

@bedevere-bot bedevere-bot removed the needs backport to 3.10 only security fixes label Jul 24, 2022
@bedevere-bot
Copy link

GH-95209 is a backport of this pull request to the 3.10 branch.

pablogsal added a commit to pablogsal/cpython that referenced this pull request Jul 24, 2022
@pablogsal
[3.10] pythongh-95185: Check recursion depth in the AST constructor (p…
eabe3cf 
…ythonGH-95186)

Co-authored-by: Serhiy Storchaka <[email protected]>.
(cherry picked from commit 0047447)

Co-authored-by: Pablo Galindo Salgado <[email protected]>
Signed-off-by: Pablo Galindo <[email protected]>
@python python deleted a comment from bedevere-bot Jul 24, 2022
@ambv
Copy link
Contributor

ambv commented Jul 25, 2022

A similar issue didn't get backported to 3.9 #25634

We may need to discuss this (check PSRT @ambv)

@pablogsal, since you aborted backporting GH-95186 (this PR) to 3.10 due to the ABI change, do you still think I should be backporting GH-25634, which I aborted due to ABI changes?

@pablogsal
Copy link
Member Author

A similar issue didn't get backported to 3.9 #25634

We may need to discuss this (check PSRT @ambv)

@pablogsal, since you aborted backporting GH-95186 (this PR) to 3.10 due to the ABI change, do you still think I should be backporting GH-25634, which I aborted due to ABI changes?

The ABI is changing but I don't think is in a way that can break things in extension modules. It may break profilers and debuggers thought.

ambv pushed a commit that referenced this pull request Jul 26, 2022
@miss-islington @pablogsal
[3.11] gh-95185: Check recursion depth in the AST constructor (GH-95186…
86eb500 
…) (GH-95208)

Co-authored-by: Serhiy Storchaka <[email protected]>
(cherry picked from commit 0047447)

Co-authored-by: Pablo Galindo Salgado <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@serhiy-storchaka serhiy-storchaka serhiy-storchaka approved these changes

@isidentical isidentical isidentical approved these changes

Assignees

@pablogsal pablogsal

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

AST constructor can stack overflow when compiling some deep trees
7 participants
@pablogsal @graingert @miss-islington @bedevere-bot @ambv @serhiy-storchaka @isidentical