[3.11] gh-120384: gh-120298: Fix array-out-of-bounds & use after free list#121345
Uh oh!
There was an error while loading. Please reload this page.
Conversation
pythonGH-120442) (python#120825) pythongh-120384: Fix array-out-of-bounds crash in `list_ass_subscript` (pythonGH-120442) (cherry picked from commit 8334a1b) Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
This backports the fix to python#120298. commit id b884536
gpshead changed the title list_ass_subscriptlistgpshead commented Jul 3, 2024
For consideration as a security related backport. To trigger these, people already need the ability to run arbitrary Python code. So we don't consider this a vulnerability given the existing capabilities. But it could make the life of some projects built on top of Python a little better. Such projects are already on undefined behavior grounds if they consider anything executing Python bytecode to not be able to escape that to begin with. Because CPython does not guarantee any such thing. |
pablogsal left a comment
pablogsal left a comment There was a problem hiding this comment.
Just commenting that I am happy to get this fix backported once it's reviewed and tested
gpshead added needs backport to 3.9 needs backport to 3.10 
bedevere-bot commented Aug 17, 2025
🤖 New build scheduled with the buildbot fleet by @gpshead for commit de70708 🤖 Results will be shown at: https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F121345%2Fmerge If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again. |
bedevere-bot removed the 🔨 test-with-buildbots 
ambv merged commit 0cd888b into python:3.11Uh oh!
There was an error while loading. Please reload this page.
…e after free `list` (pythonGH-121345) (cherry picked from commit 8334a1b) (cherry picked from commit 0cd888b) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Nikita Sobolev <mail@sobolevn.me> Co-authored-by: Łukasz Langa <lukasz@langa.pl>
…e after free `list` (pythonGH-121345) (cherry picked from commit 8334a1b) (cherry picked from commit 0cd888b) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Nikita Sobolev <mail@sobolevn.me> Co-authored-by: Łukasz Langa <lukasz@langa.pl>
GH-140833 is a backport of this pull request to the 3.10 branch. |
GH-140834 is a backport of this pull request to the 3.9 branch. |
5 participants
gh-120384: Fix array-out-of-bounds crash in
list_ass_subscript(GH-120442) (cherry picked from commit 8334a1b in the 3.12 branch)gh-120298: Fix use after free in
list_richcompare.