Possible overflow in typeobject.c:tail_contains

[federicovalenso]

Bug report

Bug description:

whence+1 could lead to overflow for large value of whence. I think changing type from int to _Py_ssizet could fix the problem (remain is input parameter):

static int
pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size)
{
...
    remain = PyMem_New(Py_ssize_t, to_merge_size);

CPython versions tested on:

3.11

Operating systems tested on:

Linux

[picnixz]

This one is used in

        candidate = PyTuple_GET_ITEM(cur_tuple, remain[i]);
        for (j = 0; j < to_merge_size; j++) {
            PyObject *j_lst = to_merge[j];
            if (tail_contains(j_lst, remain[j], candidate))
                goto skip; /* continue outer loop */
        }

and for the MRO resolution. Unless we have a VERY huge list of parent classes, I don't think we would hit the overflow.

[picnixz]

cc @JelleZijlstra

[federicovalenso]

@picnixz , should I try to overflow inheritance list? :) Or is there already protection against this?

[picnixz]

Yes, if you can make it happen! (I don't know whether there's a protection)