X Tutup
Skip to content

gh-95185: Check recursion depth in the AST constructor#95186

Merged
pablogsal merged 3 commits intopython:mainfrom
pablogsal:recursion
Jul 24, 2022
Merged

gh-95185: Check recursion depth in the AST constructor#95186
pablogsal merged 3 commits intopython:mainfrom
pablogsal:recursion

Conversation

@pablogsal
Copy link
Member

@pablogsal pablogsal commented Jul 23, 2022 •
edited
Loading

@pablogsal pablogsal requested a review from isidentical as a code owner July 23, 2022 23:29
@pablogsal pablogsal added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Jul 23, 2022
@pablogsal pablogsal force-pushed the recursion branch 2 times, most recently from 95853f4 to 3057a67 Compare July 23, 2022 23:43
@pablogsal
pythongh-95185: Check recursion depth in the AST constructor
dcdfb68 
Signed-off-by: Pablo Galindo <pablogsal@gmail.com>
@graingert
Copy link
Contributor

graingert commented Jul 23, 2022

A similar issue didn't get backported to 3.9 #25634

@pablogsal
Copy link
Member Author

pablogsal commented Jul 24, 2022

A similar issue didn't get backported to 3.9 #25634

We may need to discuss this (check PSRT @ambv)

isidentical
isidentical reviewed Jul 24, 2022
View reviewed changes
serhiy-storchaka
serhiy-storchaka reviewed Jul 24, 2022
View reviewed changes
Copy link
Member

@serhiy-storchaka serhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the code is generated and functions only have one exit on failure, you can add state->recursion_depth-- also for failure, and check the balance on failure too, as in symtable, etc.

I did not decremented the recursion depth on failure in ast_opt because functions there have multiple failure exits, so it would complicate the code. But in this case it will complicate the code.

serhiy-storchaka
serhiy-storchaka approved these changes Jul 24, 2022
View reviewed changes
Copy link
Member

@serhiy-storchaka serhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In any case LGTM.

pablogsal and others added 2 commits July 24, 2022 13:34
@pablogsal @serhiy-storchaka
Update Parser/asdl_c.py
a11956d 
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@pablogsal @serhiy-storchaka
Update Parser/asdl_c.py
853fda6 
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Signed-off-by: Pablo Galindo <pablogsal@gmail.com>
@pablogsal pablogsal merged commit 0047447 into python:main Jul 24, 2022
@pablogsal pablogsal deleted the recursion branch July 24, 2022 14:58
@miss-islington
Copy link
Contributor

miss-islington commented Jul 24, 2022

Thanks @pablogsal for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jul 24, 2022
@pablogsal @miss-islington
pythongh-95185: Check recursion depth in the AST constructor (pythonG…
8794d47 
…H-95186)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
(cherry picked from commit 0047447)

Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
@bedevere-bot bedevere-bot removed the needs backport to 3.11 only security fixes label Jul 24, 2022
@bedevere-bot
Copy link

bedevere-bot commented Jul 24, 2022

GH-95208 is a backport of this pull request to the 3.11 branch.

@miss-islington
Copy link
Contributor

miss-islington commented Jul 24, 2022

Sorry, @pablogsal, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 00474472944944b346d8409cfded84bb299f601a 3.10

@bedevere-bot bedevere-bot removed the needs backport to 3.10 only security fixes label Jul 24, 2022
@bedevere-bot
Copy link

bedevere-bot commented Jul 24, 2022

GH-95209 is a backport of this pull request to the 3.10 branch.

pablogsal added a commit to pablogsal/cpython that referenced this pull request Jul 24, 2022
@pablogsal
[3.10] pythongh-95185: Check recursion depth in the AST constructor (p…
eabe3cf 
…ythonGH-95186)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>.
(cherry picked from commit 0047447)

Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
Signed-off-by: Pablo Galindo <pablogsal@gmail.com>
@python python deleted a comment from bedevere-bot Jul 24, 2022
@ambv
Copy link
Contributor

ambv commented Jul 25, 2022

A similar issue didn't get backported to 3.9 #25634

We may need to discuss this (check PSRT @ambv)

@pablogsal, since you aborted backporting GH-95186 (this PR) to 3.10 due to the ABI change, do you still think I should be backporting GH-25634, which I aborted due to ABI changes?

@pablogsal
Copy link
Member Author

pablogsal commented Jul 25, 2022

A similar issue didn't get backported to 3.9 #25634

We may need to discuss this (check PSRT @ambv)

@pablogsal, since you aborted backporting GH-95186 (this PR) to 3.10 due to the ABI change, do you still think I should be backporting GH-25634, which I aborted due to ABI changes?

The ABI is changing but I don't think is in a way that can break things in extension modules. It may break profilers and debuggers thought.

ambv pushed a commit that referenced this pull request Jul 26, 2022
@miss-islington @pablogsal
[3.11] gh-95185: Check recursion depth in the AST constructor (GH-95186…
86eb500 
…) (GH-95208)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
(cherry picked from commit 0047447)

Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@serhiy-storchaka serhiy-storchaka serhiy-storchaka approved these changes

@isidentical isidentical isidentical approved these changes

Assignees

@pablogsal pablogsal

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

AST constructor can stack overflow when compiling some deep trees

7 participants

@pablogsal @graingert @miss-islington @bedevere-bot @ambv @serhiy-storchaka @isidentical
X Tutup