From f397a3ec318f3ad05aa287764ae7cef32202380f Mon Sep 17 00:00:00 2001 From: Damien George Date: Tue, 21 Nov 2023 22:28:57 +1100 Subject: [PATCH] py/objslice: Validate that the argument to indices() is an integer. Otherwise passing in a non-integer can lead to an invalid memory access. Thanks to Junwha Hong and Wonil Jang @S2Lab, UNIST for finding the issue. Fixes issue #13007. Signed-off-by: Damien George --- py/objslice.c | 2 +- tests/basics/slice_indices.py | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/py/objslice.c b/py/objslice.c index 75fa3bc3f5..dcd6af8b28 100644 --- a/py/objslice.c +++ b/py/objslice.c @@ -54,7 +54,7 @@ STATIC mp_obj_t slice_unary_op(mp_unary_op_t op, mp_obj_t o_in) { #if MICROPY_PY_BUILTINS_SLICE_INDICES STATIC mp_obj_t slice_indices(mp_obj_t self_in, mp_obj_t length_obj) { - mp_int_t length = mp_obj_int_get_checked(length_obj); + mp_int_t length = mp_obj_get_int(length_obj); mp_bound_slice_t bound_indices; mp_obj_slice_indices(self_in, length, &bound_indices); diff --git a/tests/basics/slice_indices.py b/tests/basics/slice_indices.py index b7f439ccca..ccd7667e9b 100644 --- a/tests/basics/slice_indices.py +++ b/tests/basics/slice_indices.py @@ -25,3 +25,8 @@ print(A()[2:7:2].indices(5)) print(A()[2:7:-2].indices(5)) print(A()[7:2:2].indices(5)) print(A()[7:2:-2].indices(5)) + +try: + print(A()[::].indices(None)) +except TypeError: + print("TypeError")