Skip to content

Unchecked signed integer overflow in PyLong_AsPid() #117021

Closed
@serhiy-storchaka

Description

@serhiy-storchaka

If pid_t has the same size as int, PyLong_AsPid is defined as PyLong_AsLong. if the size of int is less than the size of long, there are values out of the C int range but in the C long range. Calling PyLong_AsPid() with such argument will not raise an exception, but casting the result out of the C int range to pid_t has undefined behavior.

Most non-Windows 64-bit platforms are affected.

The simplest solution is to define PyLong_AsPid as PyLong_AsInt. It only applicable in 3.13, because PyLong_AsInt is new in 3.13. In older versions there is _PyLong_AsInt, but it is declared in Include/cpython/longobject.h, not in Include/longobject.h.

cc @vstinner, @pitrou

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.11only security fixes3.12only security fixes3.13bugs and security fixestopic-C-API

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions