`sys.set_int_max_str_digits` limit is not enforced for large integers
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 77.2k
- Forks
- 35.9k
- PR merge metrics
- PR metrics pending
Description
Bug report
Bug description:
Description
The sys.set_int_max_str_digits() function appears to not enforce the configured limit when converting a very large integer to a string. This could potentially bypass the intended denial-of-service protection that the limit is designed to provide.
When setting a limit, it is expected that any integer-to-string conversion that would result in a string with more digits than the limit will raise a ValueError. However, for certain large numbers, this check does not seem to occur, and the conversion succeeds without error. I tested this with the maximum number of digits set to 100,000. This allowed numbers with up to 100424 digits but threw an error for numbers with 100425 or more digits.
This doesn't seem to be an issue for all possible inputs to the sys.set_int_max_str_digits() method. For instance, I also tested it with the maximum number of digits set to 640. It correctly threw an error when I tried to do str(10**640).
Steps to Reproduce
10**100423 has 100424 digits, therefore str(10**100423) should throw a ValueError but it does not. Instead, the code below prints 100424.
import sys
sys.set_int_max_str_digits(100000)
number_str = str(10**100423)
print(len(number_str))
CPython versions tested on:
3.12
Operating systems tested on:
Windows
Linked PRs
- gh-136279
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review linked PR gh-136279 first, then use the issue's Python reproduction as the entry point; no source file or test is named in the report. Verify the intended ValueError behavior for the 100,000-digit limit while preserving the reported passing behavior with a limit of 640.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 20/100