diff options
| author | Damien George <damien@micropython.org> | 2023-11-21 22:28:57 +1100 |
|---|---|---|
| committer | Damien George <damien@micropython.org> | 2023-11-21 22:28:57 +1100 |
| commit | f397a3ec318f3ad05aa287764ae7cef32202380f (patch) | |
| tree | 97fad3f7e5d4d9e5b746f790fc5a42a9eafc9df8 | |
| parent | fce8d9fd55409ab1027beee5671bc653fb5beb97 (diff) | |
py/objslice: Validate that the argument to indices() is an integer.
Otherwise passing in a non-integer can lead to an invalid memory access.
Thanks to Junwha Hong and Wonil Jang @S2Lab, UNIST for finding the issue.
Fixes issue #13007.
Signed-off-by: Damien George <damien@micropython.org>
| -rw-r--r-- | py/objslice.c | 2 | ||||
| -rw-r--r-- | tests/basics/slice_indices.py | 5 |
2 files changed, 6 insertions, 1 deletions
diff --git a/py/objslice.c b/py/objslice.c index 75fa3bc3f..dcd6af8b2 100644 --- a/py/objslice.c +++ b/py/objslice.c @@ -54,7 +54,7 @@ STATIC mp_obj_t slice_unary_op(mp_unary_op_t op, mp_obj_t o_in) { #if MICROPY_PY_BUILTINS_SLICE_INDICES STATIC mp_obj_t slice_indices(mp_obj_t self_in, mp_obj_t length_obj) { - mp_int_t length = mp_obj_int_get_checked(length_obj); + mp_int_t length = mp_obj_get_int(length_obj); mp_bound_slice_t bound_indices; mp_obj_slice_indices(self_in, length, &bound_indices); diff --git a/tests/basics/slice_indices.py b/tests/basics/slice_indices.py index b7f439ccc..ccd7667e9 100644 --- a/tests/basics/slice_indices.py +++ b/tests/basics/slice_indices.py @@ -25,3 +25,8 @@ print(A()[2:7:2].indices(5)) print(A()[2:7:-2].indices(5)) print(A()[7:2:2].indices(5)) print(A()[7:2:-2].indices(5)) + +try: + print(A()[::].indices(None)) +except TypeError: + print("TypeError") |