Skip to content

gh-150587: Harden BINARY_OP_SUBSCR_LIST_INT/STORE_SUBSCR_LIST_INT against non-compact int subscripts#150588

Closed
KRRT7 wants to merge 3 commits into
python:mainfrom
KRRT7:fix-subscr-list-int-wide-deopt
Closed

gh-150587: Harden BINARY_OP_SUBSCR_LIST_INT/STORE_SUBSCR_LIST_INT against non-compact int subscripts#150588
KRRT7 wants to merge 3 commits into
python:mainfrom
KRRT7:fix-subscr-list-int-wide-deopt

Conversation

@KRRT7
Copy link
Copy Markdown

@KRRT7 KRRT7 commented May 29, 2026

Add EXIT_IF(!_PyLong_IsNonNegativeCompact(...)) to _BINARY_OP_SUBSCR_LIST_INT and DEOPT_IF(!_PyLong_IsNonNegativeCompact(...)) to _STORE_SUBSCR_LIST_INT before the _PyLong_CompactValue call.

Both opcodes currently rely on _GUARD_TOS_INT having already rejected non-compact ints, but do not enforce this themselves. If _GUARD_TOS_INT were relaxed, _PyLong_CompactValue would be called on a wide int, silently reading ob_digit[0] as the index instead of the full value.

Fixes gh-150587.

@KRRT7 KRRT7 requested a review from markshannon as a code owner May 29, 2026 19:28
@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented May 29, 2026

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

@KRRT7
Copy link
Copy Markdown
Author

KRRT7 commented May 30, 2026

closing as per #150587 (comment):

my work on 150425 is what triggers this bug, and is why I had opened this issue. after a chat with @ZeroIntensity I'm moving the patch into 150425

@KRRT7 KRRT7 closed this May 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BINARY_OP_SUBSCR_LIST_INT / STORE_SUBSCR_LIST_INT silently depend on _GUARD_TOS_INT enforcing compactness

1 participant