python / python/cpython

`sys.set_int_max_str_digits` limit is not enforced for large integers

未关闭
#136,250 7 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

docs
主要语言
Python
星标
77.2k
派生
35.9k
PR 合并指标
PR 指标待抓取

描述

Bug report

Bug description:

Description

The sys.set_int_max_str_digits() function appears to not enforce the configured limit when converting a very large integer to a string. This could potentially bypass the intended denial-of-service protection that the limit is designed to provide.

When setting a limit, it is expected that any integer-to-string conversion that would result in a string with more digits than the limit will raise a ValueError. However, for certain large numbers, this check does not seem to occur, and the conversion succeeds without error. I tested this with the maximum number of digits set to 100,000. This allowed numbers with up to 100424 digits but threw an error for numbers with 100425 or more digits.
This doesn't seem to be an issue for all possible inputs to the sys.set_int_max_str_digits() method. For instance, I also tested it with the maximum number of digits set to 640. It correctly threw an error when I tried to do str(10**640).

Steps to Reproduce

10**100423 has 100424 digits, therefore str(10**100423) should throw a ValueError but it does not. Instead, the code below prints 100424.

import sys

sys.set_int_max_str_digits(100000)

number_str = str(10**100423)
print(len(number_str))
CPython versions tested on:

3.12

Operating systems tested on:

Windows

Linked PRs
  • gh-136279

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue,再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库,在一个分支上完成修改。
  4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

调研方向

先查看关联的 PR gh-136279,然后以 issue 的 Python 复现作为切入点;报告中没有指定源文件或测试。验证 100,000 位数限制下预期的 ValueError 行为,同时保留限制为 640 时报告的通过行为。

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
backend
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
描述清楚
新手友好度
20/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。