Fix crasher in unpacking assignments with star, where the size constraints

weren't checked.

diff --git a/Lib/test/test_unpack_ex.py b/Lib/test/test_unpack_ex.py
index 7fe486bc08e603390db5d5af3a390c01dccfe14e..89486b8d2d419f0f8f351a0835293a3fd6e39483 100644 (file)
--- a/Lib/test/test_unpack_ex.py
+++ b/Lib/test/test_unpack_ex.py
@@ -143,6 +143,23 @@ Now some general starred expressions (all fail).
       ...
     SyntaxError: can use starred expression only as assignment target
 
+Some size constraints (all fail.)
+
+    >>> s = ", ".join("a%d" % i for i in range(1<<8)) + ", *rest = range(1<<8 + 1)"
+    >>> compile(s, 'test', 'exec') # doctest:+ELLIPSIS
+    Traceback (most recent call last):
+     ...
+    SyntaxError: too many expressions in star-unpacking assignment
+
+    >>> s = ", ".join("a%d" % i for i in range(1<<8 + 1)) + ", *rest = range(1<<8 + 2)"
+    >>> compile(s, 'test', 'exec') # doctest:+ELLIPSIS
+    Traceback (most recent call last):
+     ...
+    SyntaxError: too many expressions in star-unpacking assignment
+
+(there is an additional limit, on the number of expressions after the
+'*rest', but it's 1<<24 and testing it takes too much memory.)
+
 """
 
 __test__ = {'doctests' : doctests}

diff --git a/Python/compile.c b/Python/compile.c
index af6e0676ba43871acba3d410b429ebcc09ec2215..f415519855c118ddabbed99bb41437e4279dac34 100644 (file)
--- a/Python/compile.c
+++ b/Python/compile.c
@@ -2614,6 +2614,11 @@ compiler_list(struct compiler *c, expr_ty e)
                for (i = 0; i < n; i++) {
                        expr_ty elt = asdl_seq_GET(e->v.List.elts, i);
                        if (elt->kind == Starred_kind && !seen_star) {
+                               if ((i >= (1 << 8)) ||
+                                   (n-i-1 >= (INT_MAX >> 8)))
+                                       return compiler_error(c,
+                                               "too many expressions in "
+                                               "star-unpacking assignment");
                                ADDOP_I(c, UNPACK_EX, (i + ((n-i-1) << 8)));
                                seen_star = 1;
                                asdl_seq_SET(e->v.List.elts, i, elt->v.Starred.value);
@@ -2642,6 +2647,11 @@ compiler_tuple(struct compiler *c, expr_ty e)
                for (i = 0; i < n; i++) {
                        expr_ty elt = asdl_seq_GET(e->v.Tuple.elts, i);
                        if (elt->kind == Starred_kind && !seen_star) {
+                               if ((i >= (1 << 8)) ||
+                                   (n-i-1 >= (INT_MAX >> 8)))
+                                       return compiler_error(c,
+                                               "too many expressions in "
+                                               "star-unpacking assignment");
                                ADDOP_I(c, UNPACK_EX, (i + ((n-i-1) << 8)));
                                seen_star = 1;
                                asdl_seq_SET(e->v.Tuple.elts, i, elt->v.Starred.value);