python / python/cpython

`sys.set_int_max_str_digits` limit is not enforced for large integers

未關閉
#136,250 7 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

還沒有人認領這個 Issue。

docs
主要語言
Python
星號
77.2k
分支
36k
PR 合併指標
PR 指標待擷取

描述

Bug report

Bug description:

Description

The sys.set_int_max_str_digits() function appears to not enforce the configured limit when converting a very large integer to a string. This could potentially bypass the intended denial-of-service protection that the limit is designed to provide.

When setting a limit, it is expected that any integer-to-string conversion that would result in a string with more digits than the limit will raise a ValueError. However, for certain large numbers, this check does not seem to occur, and the conversion succeeds without error. I tested this with the maximum number of digits set to 100,000. This allowed numbers with up to 100424 digits but threw an error for numbers with 100425 or more digits.
This doesn't seem to be an issue for all possible inputs to the sys.set_int_max_str_digits() method. For instance, I also tested it with the maximum number of digits set to 640. It correctly threw an error when I tried to do str(10**640).

Steps to Reproduce

10**100423 has 100424 digits, therefore str(10**100423) should throw a ValueError but it does not. Instead, the code below prints 100424.

import sys

sys.set_int_max_str_digits(100000)

number_str = str(10**100423)
print(len(number_str))
CPython versions tested on:

3.12

Operating systems tested on:

Windows

Linked PRs
  • gh-136279

貢獻指南

開啟貢獻指南

從這裡開始

  1. 先讀完整個 Issue,再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫,在一個分支上完成修改。
  4. 送出 Pull Request,並在描述裡引用這個 Issue 編號。

研究方向

先查看關聯的 PR gh-136279,然後以 issue 的 Python 重現作為切入點;報告中沒有指定原始檔案或測試。驗證 100,000 位數限制下預期的 ValueError 行為,同時保留限制為 640 時報告的通過行為。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
python
領域
backend
Issue 類型
缺陷
難度
4/5
預估耗時
3-5 天
活躍度
停滯
描述清晰度
描述清楚
新手友好度
20/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。