-
-
Notifications
You must be signed in to change notification settings - Fork 34.5k
gh-115952: Fix a potential virtual memory allocation denial of service in pickle #119204
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
serhiy-storchaka
merged 30 commits into
python:main
from
serhiy-storchaka:unpickle-overallocate
Dec 5, 2025
Merged
Changes from 1 commit
Commits
Show all changes
30 commits
Select commit
Hold shift + click to select a range
822230d
gh-115952: Fix vulnerability in the pickle module
serhiy-storchaka 88f1461
Try to fix tests of 32-bit platforms.
serhiy-storchaka 048099b
Try to fix more tests on 32-bit platforms.
serhiy-storchaka d9d1d1d
Apply suggestions from code review
serhiy-storchaka 6f6f765
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka d0e667e
Remove empty lines.
serhiy-storchaka 3462d0e
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka becbd25
Merge remote-tracking branch 'refs/remotes/origin/unpickle-overalloca…
serhiy-storchaka b257974
Change names, add more commentis and update the NEWS entry.
serhiy-storchaka 1e487ca
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 184984d
Support arbitrary non-continuous memo keys.
serhiy-storchaka f0c0728
Reworded NEWS a bit.
gpshead 1f4e2f1
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka c72d095
Fix C to Python integer conversion.
serhiy-storchaka e89bfea
Add more comments.
serhiy-storchaka a80106c
Fix test on 32-bit platforms.
serhiy-storchaka 01bc6b9
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 20aa1bf
Fix __sizeof__.
serhiy-storchaka ab58869
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 2a1cff8
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 9d4af4e
Improve security in pickle module
serhiy-storchaka 572a2f2
reword NEWS a bit
gpshead d6279ae
add a couple of comments
gpshead 022108d
expand comment in test_too_large_long_binput
gpshead f5f50e7
Add memory DoS impact benchmark for pickle module
gpshead 44dbe03
fix docs build?
gpshead a29c90c
Merge branch 'main' into unpickle-overallocate
gpshead 583df53
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 54dfd58
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 7afe4e1
Update comments.
serhiy-storchaka File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
expand comment in test_too_large_long_binput
- Loading branch information
commit 022108def3aa22f0cfe817a4e1336cbfb27907b3
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I removed this sentence because the test actually does not depend on any thresholds. It starts with
1 << 20just to save time, but it will work for smaller or larger thresholds.