Skip to content

gh-158446: Reject float format precision near INT_MAX - #158474

Merged
gpshead merged 4 commits into
python:mainfrom
gpshead:dtoa-precision-limit
Sep 30, 2026
Merged

gpshead merged 4 commits into
python:mainfrom
gpshead:dtoa-precision-limit

Conversation

@gpshead

@gpshead gpshead commented Sep 30, 2026 •

Copy link
Copy Markdown
Member

PyOS_double_to_string() now raises ValueError("precision too big") for precisions above INT_MAX - 1024, matching what the format parsers already do above INT_MAX. Buffer size computations in pystrtod.c and dtoa.c add a few hundred to the precision using int / Py_ssize_t arithmetic and could wrap for such values, leading to a crash or incorrect output.

Also harden _Py_dg_dtoa() and rv_alloc() so their size arithmetic stays in range for any C caller.


This was reviewed and approved via the PSRT in a report which we'll make public soon as security releases are about to be cut tomorrow.

PyOS_double_to_string() now raises ValueError("precision too big") for
precisions above INT_MAX - 1024, matching what the format parsers already
do above INT_MAX.  Buffer size computations in pystrtod.c and dtoa.c add a
few hundred to the precision using int / Py_ssize_t arithmetic and could
wrap for such values, leading to a crash or incorrect output.

Also harden _Py_dg_dtoa() and rv_alloc() so their size arithmetic stays in
range for any C caller.
…ording

Make the PyOS_double_to_string() precision check symmetric so that C
callers passing a huge negative precision cannot reach the remaining
precision arithmetic either.  Reword the NEWS entry: the limit applies to
float and complex formatting regardless of presentation type or value.
Note the dtoa.c deviations in its header list, cross-reference the shared
bound between dtoa.c and pystrtod.c, PEP 7 brace placement, and wrap a
long test comment.  No functional change.
@gpshead
gpshead enabled auto-merge (squash) September 30, 2026 04:48
@gpshead
gpshead merged commit b7b4f3e into python:main Sep 30, 2026
54 checks passed
@miss-islington-app

Copy link
Copy Markdown

Thanks @gpshead for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158476 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Sep 30, 2026
@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158477 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Sep 30, 2026
@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158478 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Sep 30, 2026
@miss-islington-app

Copy link
Copy Markdown

Sorry, @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker b7b4f3ecf2fce4451ee1a8e8c1b6e92dea60ce3d 3.10

@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158479 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Sep 30, 2026
@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158480 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Sep 30, 2026
@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158482 is a backport of this pull request to the 3.10 branch.

gpshead added a commit that referenced this pull request Sep 30, 2026
…) (#158478)

gh-158446: Reject float format precision near INT_MAX (GH-158474)

Formatting a float or complex with a precision within about 1000 of
INT_MAX could crash or produce incorrect output.
PyOS_double_to_string() now raises ValueError("precision too big") for
such precisions, as the format string parsers already do for
precisions above INT_MAX.

The limit applies regardless of presentation type or value, so a few
calls that previously succeeded (inf, nan, or 'g' with such a
precision) now raise as well.
(cherry picked from commit b7b4f3e)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
hugovk pushed a commit that referenced this pull request Sep 30, 2026
…) (#158476)

gh-158446: Reject float format precision near INT_MAX (GH-158474)

Formatting a float or complex with a precision within about 1000 of
INT_MAX could crash or produce incorrect output.
PyOS_double_to_string() now raises ValueError("precision too big") for
such precisions, as the format string parsers already do for
precisions above INT_MAX.

The limit applies regardless of presentation type or value, so a few
calls that previously succeeded (inf, nan, or 'g' with such a
precision) now raise as well.
(cherry picked from commit b7b4f3e)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
gpshead added a commit that referenced this pull request Sep 30, 2026
…) (#158477)

gh-158446: Reject float format precision near INT_MAX (GH-158474)

Formatting a float or complex with a precision within about 1000 of
INT_MAX could crash or produce incorrect output.
PyOS_double_to_string() now raises ValueError("precision too big") for
such precisions, as the format string parsers already do for
precisions above INT_MAX.

The limit applies regardless of presentation type or value, so a few
calls that previously succeeded (inf, nan, or 'g' with such a
precision) now raise as well.
(cherry picked from commit b7b4f3e)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Yhg1s pushed a commit that referenced this pull request Sep 30, 2026
…) (#158479)

* gh-158446: Reject float format precision near INT_MAX (GH-158474)

Formatting a float or complex with a precision within about 1000 of
INT_MAX could crash or produce incorrect output.
PyOS_double_to_string() now raises ValueError("precision too big") for
such precisions, as the format string parsers already do for
precisions above INT_MAX.

The limit applies regardless of presentation type or value, so a few
calls that previously succeeded (inf, nan, or 'g' with such a
precision) now raise as well.
(cherry picked from commit b7b4f3e)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

* gh-158446: Fix the new test_format test on 3.12

test_format.py does not import import_module on this branch.  Import
INT_MAX from _testcapi directly, as the neighboring test does.

---------

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
pablogsal pushed a commit that referenced this pull request Oct 1, 2026
…) (#158482)

Formatting a float or complex with a precision within about 1000 of
INT_MAX could crash or produce incorrect output.
PyOS_double_to_string() now raises ValueError("precision too big") for
such precisions, as the format string parsers already do for
precisions above INT_MAX.

The limit applies regardless of presentation type or value, so a few
calls that previously succeeded (inf, nan, or 'g' with such a
precision) now raise as well.
(cherry picked from commit b7b4f3e)
pablogsal pushed a commit that referenced this pull request Oct 1, 2026
…) (#158480)

* gh-158446: Reject float format precision near INT_MAX (GH-158474)

Formatting a float or complex with a precision within about 1000 of
INT_MAX could crash or produce incorrect output.
PyOS_double_to_string() now raises ValueError("precision too big") for
such precisions, as the format string parsers already do for
precisions above INT_MAX.

The limit applies regardless of presentation type or value, so a few
calls that previously succeeded (inf, nan, or 'g' with such a
precision) now raise as well.
(cherry picked from commit b7b4f3e)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

* gh-158446: Fix the new test_format test on 3.11

test_format.py does not import import_module on this branch.  Import
INT_MAX from _testcapi directly, as the neighboring test does.

---------

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release-blocker type-bug An unexpected behavior, bug, or error type-security A security issue

Projects

Development

Successfully merging this pull request may close these issues.

2 participants