Parser compares int to Py_ssize_t poorly

[zooba]

I'm not sure how widespread this is, or how generated the code is, but within _loop0_139_rule in parser.c we find this:

    Py_ssize_t _n = 0;
    // some lines later
    for (int i = 0; i < _n; i++) asdl_seq_SET_UNTYPED(_seq, i, _children[i]);

If _n can never be larger than MAX_INT (likely), there seems no reason it can't be int. Alternatively, if i has to increment all the way up to _n, it should be Py_ssize_t.

Otherwise, an infinite loop is theoretically possible, and clever static analysers will take great pride in reminding us about this possibility until we fix it.

(I'd jump in and fix this myself but I've never touched this code before and am not sure where to start. Should be easy enough for someone who does know, though.)

Linked PRs

• gh-120956: Avoid comparison of int to Py_ssize_t in parser #120959

[lysnikolaou]

Opened #120959.

[mdboom]

clever static analysers will take great pride in reminding us about this possibility until we fix it.

Was there a specific clever static analyser that found this in this case?

[zooba]

Was there a specific clever static analyser that found this in this case?

CodeQL, though running on a different copy of the repo than this one.