-
-
Notifications
You must be signed in to change notification settings - Fork 34.5k
gh-115952: Fix a potential virtual memory allocation denial of service in pickle #119204
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
serhiy-storchaka
merged 30 commits into
python:main
from
serhiy-storchaka:unpickle-overallocate
Dec 5, 2025
Merged
Changes from 1 commit
Commits
Show all changes
30 commits
Select commit
Hold shift + click to select a range
822230d
gh-115952: Fix vulnerability in the pickle module
serhiy-storchaka 88f1461
Try to fix tests of 32-bit platforms.
serhiy-storchaka 048099b
Try to fix more tests on 32-bit platforms.
serhiy-storchaka d9d1d1d
Apply suggestions from code review
serhiy-storchaka 6f6f765
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka d0e667e
Remove empty lines.
serhiy-storchaka 3462d0e
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka becbd25
Merge remote-tracking branch 'refs/remotes/origin/unpickle-overalloca…
serhiy-storchaka b257974
Change names, add more commentis and update the NEWS entry.
serhiy-storchaka 1e487ca
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 184984d
Support arbitrary non-continuous memo keys.
serhiy-storchaka f0c0728
Reworded NEWS a bit.
gpshead 1f4e2f1
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka c72d095
Fix C to Python integer conversion.
serhiy-storchaka e89bfea
Add more comments.
serhiy-storchaka a80106c
Fix test on 32-bit platforms.
serhiy-storchaka 01bc6b9
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 20aa1bf
Fix __sizeof__.
serhiy-storchaka ab58869
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 2a1cff8
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 9d4af4e
Improve security in pickle module
serhiy-storchaka 572a2f2
reword NEWS a bit
gpshead d6279ae
add a couple of comments
gpshead 022108d
expand comment in test_too_large_long_binput
gpshead f5f50e7
Add memory DoS impact benchmark for pickle module
gpshead 44dbe03
fix docs build?
gpshead a29c90c
Merge branch 'main' into unpickle-overallocate
gpshead 583df53
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 54dfd58
Merge branch 'main' into unpickle-overallocate
serhiy-storchaka 7afe4e1
Update comments.
serhiy-storchaka File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev
Previous commit
Update comments.
- Loading branch information
commit 7afe4e1caa56f6e7ee7644c60e2a0bf64f01b9ef
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you add a comment explaining why this and the next test method result in ([], []) being returned no matter what rather than an error when the values are too large? (I suspect readers with a knowledge of the specific pickle protocol may understand, but it isn't obvious otherwise)