Skip to content

Commit 4a97b15

Browse files
pablogsalpablogsal
authored
bpo-41690: Use a loop to collect args in the parser instead of recursion (GH-22053)
This program can segfault the parser by stack overflow: ``` import ast code = "f(" + ",".join(['a' for _ in range(100000)]) + ")" print("Ready!") ast.parse(code) ``` the reason is that the rule for arguments has a simple recursion when collecting args: args[expr_ty]: [...] | a=named_expression b=[',' c=args { c }] { [...] }
1 parent 3940333 commit 4a97b15

File tree

5 files changed

+628
-515
lines changed

5 files changed

+628
-515
lines changed

‎Grammar/python.gram‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -535,22 +535,11 @@ arguments[expr_ty] (memo):
535535
| a=args [','] &')' { a }
536536
| incorrect_arguments
537537
args[expr_ty]:
538-
| a=starred_expression b=[',' c=args { c }] {
539-
_Py_Call(_PyPegen_dummy_name(p),
540-
(b) ? CHECK(_PyPegen_seq_insert_in_front(p, a, ((expr_ty) b)->v.Call.args))
541-
: CHECK(_PyPegen_singleton_seq(p, a)),
542-
(b) ? ((expr_ty) b)->v.Call.keywords : NULL,
543-
EXTRA) }
538+
| a=','.(starred_expression | named_expression !'=')+ b=[',' k=kwargs {k}] { _PyPegen_collect_call_seqs(p, a, b) }
544539
| a=kwargs { _Py_Call(_PyPegen_dummy_name(p),
545540
CHECK_NULL_ALLOWED(_PyPegen_seq_extract_starred_exprs(p, a)),
546541
CHECK_NULL_ALLOWED(_PyPegen_seq_delete_starred_exprs(p, a)),
547542
EXTRA) }
548-
| a=named_expression b=[',' c=args { c }] {
549-
_Py_Call(_PyPegen_dummy_name(p),
550-
(b) ? CHECK(_PyPegen_seq_insert_in_front(p, a, ((expr_ty) b)->v.Call.args))
551-
: CHECK(_PyPegen_singleton_seq(p, a)),
552-
(b) ? ((expr_ty) b)->v.Call.keywords : NULL,
553-
EXTRA) }
554543
kwargs[asdl_seq*]:
555544
| a=','.kwarg_or_starred+ ',' b=','.kwarg_or_double_starred+ { _PyPegen_join_sequences(p, a, b) }
556545
| ','.kwarg_or_starred+

‎Misc/NEWS.d/next/Core and Builtins/2020-09-02-12-00-57.bpo-41690.Ny-Sfy.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Fix a possible stack overflow in the parser when parsing functions and
2+
classes with a huge ammount of arguments. Patch by Pablo Galindo.

0 commit comments

Comments
 (0)