diff options
| author | Andrew Leech <andrew.leech@planetinnovation.com.au> | 2022-08-07 16:24:37 +1000 |
|---|---|---|
| committer | Damien George <damien@micropython.org> | 2023-01-20 16:31:37 +1100 |
| commit | 5c4153ea379550bf595bf0bfa0e3711afea17aa0 (patch) | |
| tree | 75d7ab1912e8a3a24af38ea20a88d260eecb4dbf /py/objarray.c | |
| parent | d6bc34a13aa734d8b32e5768c021377ac4815029 (diff) | |
py/objarray: Raise error on out-of-bound memoryview slice start.
32-bit platforms only support a slice offset start of 24 bit max due to the
limited size of the mp_obj_array_t.free member. Similarly on 64-bit
platforms the limit is 56 bits.
This commit adds an OverflowError if the user attempts to slice a
memoryview beyond this limit.
Signed-off-by: Damien George <damien@micropython.org>
Diffstat (limited to 'py/objarray.c')
| -rw-r--r-- | py/objarray.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/py/objarray.c b/py/objarray.c index c66070538..0d9411d7c 100644 --- a/py/objarray.c +++ b/py/objarray.c @@ -53,6 +53,7 @@ #if MICROPY_PY_BUILTINS_MEMORYVIEW #define TYPECODE_MASK (0x7f) #define memview_offset free +#define memview_offset_max ((1LL << MP_OBJ_ARRAY_FREE_SIZE_BITS) - 1) #else // make (& TYPECODE_MASK) a null operation if memorview not enabled #define TYPECODE_MASK (~(size_t)0) @@ -522,6 +523,9 @@ STATIC mp_obj_t array_subscr(mp_obj_t self_in, mp_obj_t index_in, mp_obj_t value assert(sz > 0); #if MICROPY_PY_BUILTINS_MEMORYVIEW if (o->base.type == &mp_type_memoryview) { + if (slice.start > memview_offset_max) { + mp_raise_msg(&mp_type_OverflowError, MP_ERROR_TEXT("memoryview offset too large")); + } res = m_new_obj(mp_obj_array_t); *res = *o; res->memview_offset += slice.start; |