-
-
Notifications
You must be signed in to change notification settings - Fork 32.2k
gh-135241: Changed the opcode of _pickle module to look for 00 and 01 specifically #135242
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
The python pickle module looks for "00" and "01" but _pickle only looked for 2 characters that parsed to 0 or 1, meaning some payloads like "+0" or " 0" would lead to different results in different implementations
Lib/test/test_pickle.py
Outdated
# when getting booleans from the INT opcode. Doing a str comparison | ||
# to bypass truthy/falsy comparisons. These payloads should return | ||
# 0, not False. | ||
out1 = self.loads(b'I+0\n.') |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What about b'I001'
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The INT
opcode only looks specifically for the b'I01'
and b'I00'
values to convert to True
/False
. Because of #126992, both implementations specifically use base 10 so b'I001'
will push 1 to the stack for both, so that shouldn't be relevant here I don't think.
The python pickle module looks for "00" and "01" but _pickle only looked for 2 characters that parsed to 0 or 1, meaning some payloads like "+0" or " 0" would lead to different results in different implementations. See more details in the linked issue.
This solution simply checks for the hard-coded chars ensuring no edge cases go by.
INT
opcode boolean conversion discrepancy #135241