TonBERRY/micropython
3
0
Fork 0
Code Pull Requests Activity

py/objarray: Raise error on out-of-bound memoryview slice start.

Browse Source 
32-bit platforms only support a slice offset start of 24 bit max due to the
limited size of the mp_obj_array_t.free member.  Similarly on 64-bit
platforms the limit is 56 bits.

This commit adds an OverflowError if the user attempts to slice a
memoryview beyond this limit.

Signed-off-by: Damien George <damien@micropython.org>
This commit is contained in:
Andrew Leech
2022-08-07 16:24:37 +10:00
committed by Damien George
parent d6bc34a13a
commit 5c4153ea37
4 changed files with 37 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
py/objarray.c
View File

@@ -53,6 +53,7 @@
#if MICROPY_PY_BUILTINS_MEMORYVIEW
#define TYPECODE_MASK (0x7f)
#define memview_offset free
#define memview_offset_max ((1LL << MP_OBJ_ARRAY_FREE_SIZE_BITS) - 1)
#else
// make (& TYPECODE_MASK) a null operation if memorview not enabled
#define TYPECODE_MASK (~(size_t)0)
@@ -522,6 +523,9 @@ STATIC mp_obj_t array_subscr(mp_obj_t self_in, mp_obj_t index_in, mp_obj_t value
assert(sz > 0);
#if MICROPY_PY_BUILTINS_MEMORYVIEW
if (o->base.type == &mp_type_memoryview) {
if (slice.start > memview_offset_max) {
mp_raise_msg(&mp_type_OverflowError, MP_ERROR_TEXT("memoryview offset too large"));
}
res = m_new_obj(mp_obj_array_t);
*res = *o;
res->memview_offset += slice.start;