Compare commits

...

4 commits

Author SHA1 Message Date
Jeff Epler
9677b0860f Add tests for fixed crashes 2018-03-27 17:37:42 -05:00
Jeff Epler
d649c6f3d0 fixup! mp_map_lookup: Throw exception in this case 2018-03-27 17:37:28 -05:00
Jeff Epler
d148da6a6d fix crash in error reporting with bad keyword arguments
Provoked with e.g.,
    def f(a, b):
        print(a, b)

    f(1, **{len:2})
2018-03-26 22:04:07 -05:00
Jeff Epler
d5dbe3020b mp_map_lookup: Throw exception in this case
This assertion could be triggered by a number of patterns found by
afl-fuzz, such as `del str.partition`, `property.start = 0`, etc.
2018-03-26 21:43:44 -05:00
3 changed files with 37 additions and 1 deletions

View file

@ -190,6 +190,9 @@ void mp_setup_code_state(mp_code_state_t *code_state, size_t n_args, size_t n_kw
for (size_t i = 0; i < n_kw; i++) { for (size_t i = 0; i < n_kw; i++) {
// the keys in kwargs are expected to be qstr objects // the keys in kwargs are expected to be qstr objects
mp_obj_t wanted_arg_name = kwargs[2 * i]; mp_obj_t wanted_arg_name = kwargs[2 * i];
if(MP_UNLIKELY(!MP_OBJ_IS_QSTR(wanted_arg_name))) {
mp_raise_TypeError("unexpected keyword argument");
}
for (size_t j = 0; j < n_pos_args + n_kwonly_args; j++) { for (size_t j = 0; j < n_pos_args + n_kwonly_args; j++) {
if (wanted_arg_name == arg_names[j]) { if (wanted_arg_name == arg_names[j]) {
if (code_state->state[n_state - 1 - j] != MP_OBJ_NULL) { if (code_state->state[n_state - 1 - j] != MP_OBJ_NULL) {

View file

@ -137,7 +137,10 @@ STATIC void mp_map_rehash(mp_map_t *map) {
// - returns NULL if not found, else the slot if was found in with key null and value non-null // - returns NULL if not found, else the slot if was found in with key null and value non-null
mp_map_elem_t *mp_map_lookup(mp_map_t *map, mp_obj_t index, mp_map_lookup_kind_t lookup_kind) { mp_map_elem_t *mp_map_lookup(mp_map_t *map, mp_obj_t index, mp_map_lookup_kind_t lookup_kind) {
// If the map is a fixed array then we must only be called for a lookup // If the map is a fixed array then we must only be called for a lookup
assert(!map->is_fixed || lookup_kind == MP_MAP_LOOKUP); if (MP_UNLIKELY(map->is_fixed && lookup_kind != MP_MAP_LOOKUP)) {
mp_raise_TypeError("unsupported operation on fixed map");
}
// Work out if we can compare just pointers // Work out if we can compare just pointers
bool compare_only_ptrs = map->all_keys_are_qstrs; bool compare_only_ptrs = map->all_keys_are_qstrs;

30
tests/misc/crashes.py Normal file
View file

@ -0,0 +1,30 @@
def assertRaises(arg):
if issubclass(arg, Exception):
def inner(fn):
try:
fn()
except arg:
print(True)
else: print(False)
return inner
else:
try:
fn()
except:
print(True)
else:
print(False)
@assertRaises(TypeError)
def f():
del str.partition
@assertRaises(TypeError)
def f():
property.start = 0
@assertRaises(TypeError)
def f():
def inner(a, b):
print(a, b)
inner(1, **{len: 2})