[security] list_resize(): integer overflow if newsize is too large

[vstinner]

Jordan Limor reported an issue in the C list_resize() function called when a Python list is resized:

When list_resize is hit with the maximum value for a c_ssize_t, the
overallocation strategy causes an overflow in the total allocated bytes.
This results in a call to PyMem_Realloc where the argument is 0 (and one
byte is allocated), but the resulting list's size is set to PY_SSIZE_T_MAX.

Example bug.py:

import sys
import faulthandler; faulthandler.enable()

x=[0]*65
del x[1:]
assert len(x) == 1

print("resize list", flush=True)
max_size = ((2 ** (tuple.__itemsize__ * 8) - 1) // 2)
x *= max_size
print(f"{len(x)=}")
print(f"{sys.getsizeof(x)=}")

# crash on reading uninitizalized memory
print("x[8]=", end="", flush=True)
print(x[8])

Output:

$ python3.10 bug.py 
resize list
Fatal Python error: Segmentation fault

Current thread 0x00007fe16ead0740 (most recent call first):
  File "bug.py", line 10 in <module>
Erreur de segmentation (core dumped)

• PR: gh-97616: test_list_resize_overflow() uses sys.maxsize #99057

[vstinner]

When the bug triggers, list_resize() is called with newsize=9223372036854775807: 2**63-1 (PY_SSIZE_T_MAX).

new_allocated = ((size_t)newsize + (newsize >> 3) + 6) & ~(size_t)3; gives 10376293541461622788.

But (newsize - Py_SIZE(self) > (Py_ssize_t)(new_allocated - newsize)) condition is true, and so new_allocated = ((size_t)newsize + 3) & ~(size_t)3; is computed which gives new_allocated=9223372036854775808 which is PY_SSIZE_T_MAX + 1.

The integer overflow occurs on num_allocated_bytes = new_allocated * sizeof(PyObject *); which gives: num_allocated_bytes=0.

[gpshead]

The PRs were merged, I believe this is complete.

[mattip]

In the test, isn't the calculation max_size = ((2 ** (tuple.__itemsize__ * 8) - 1) // 2) always going to yield sys.maxsize? It seems so on linux64, linux32, win64. I ask because PyPy has no tuple.__itemsize__ and it seems this is an implementation detail.

[vstinner]

In the test, isn't the calculation max_size = ((2 ** (tuple.itemsize * 8) - 1) // 2) always going to yield sys.maxsize?

I wrote the test based on the code that we received to trigger the crash. I wrote PR #99057 to fix the case, is it better for PyPy?