Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Correct CVE-2020-10735 documentation #100306

Merged
merged 3 commits into from
Dec 18, 2022
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions Doc/library/stdtypes.rst
Original file line number Diff line number Diff line change
Expand Up @@ -5480,7 +5480,7 @@ to mitigate denial of service attacks. This limit *only* applies to decimal or
other non-power-of-two number bases. Hexadecimal, octal, and binary conversions
are unlimited. The limit can be configured.

The :class:`int` type in CPython is an abitrary length number stored in binary
The :class:`int` type in CPython is an arbitrary length number stored in binary
form (commonly known as a "bignum"). There exists no algorithm that can convert
a string to a binary integer or a binary integer to a string in linear time,
*unless* the base is a power of 2. Even the best known algorithms for base 10
Expand Down Expand Up @@ -5544,7 +5544,7 @@ and :class:`str` or :class:`bytes`:
* ``int(string)`` with default base 10.
* ``int(string, base)`` for all bases that are not a power of 2.
* ``str(integer)``.
* ``repr(integer)``
* ``repr(integer)``.
* any other string conversion to base 10, for example ``f"{integer}"``,
``"{}".format(integer)``, or ``b"%d" % integer``.

Expand Down Expand Up @@ -5572,7 +5572,7 @@ command line flag to configure the limit:
:envvar:`PYTHONINTMAXSTRDIGITS` or :option:`-X int_max_str_digits <-X>`.
If both the env var and the ``-X`` option are set, the ``-X`` option takes
precedence. A value of *-1* indicates that both were unset, thus a value of
:data:`sys.int_info.default_max_str_digits` was used during initilization.
:data:`sys.int_info.default_max_str_digits` was used during initialization.

From code, you can inspect the current limit and set a new one using these
:mod:`sys` APIs:
Expand Down
5 changes: 5 additions & 0 deletions Doc/library/xmlrpc.client.rst
Original file line number Diff line number Diff line change
Expand Up @@ -548,6 +548,11 @@ Convenience Functions
.. versionchanged:: 3.3
The *use_builtin_types* flag was added.

.. versionchanged:: 3.11
Conversion to :class:`int` now limits the maximum length of the integer
string via the interpreter's :ref:`integer string conversion length
limitation <int_max_str_digits>` to help avoid denial of service attacks.


.. _xmlrpc-client-example:

Expand Down
4 changes: 2 additions & 2 deletions Python/clinic/sysmodule.c.h

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions Python/sysmodule.c
Original file line number Diff line number Diff line change
Expand Up @@ -1699,12 +1699,12 @@ sys_mdebug_impl(PyObject *module, int flag)
/*[clinic input]
sys.get_int_max_str_digits

Set the maximum string digits limit for non-binary int<->str conversions.
Return the maximum string digits limit for non-binary int<->str conversions.
[clinic start generated code]*/

static PyObject *
sys_get_int_max_str_digits_impl(PyObject *module)
/*[clinic end generated code: output=0042f5e8ae0e8631 input=8dab13e2023e60d5]*/
/*[clinic end generated code: output=0042f5e8ae0e8631 input=61bf9f99bc8b112d]*/
{
PyInterpreterState *interp = _PyInterpreterState_GET();
return PyLong_FromLong(interp->long_state.max_str_digits);
Expand Down