Python pickle `load_reduce` function doesn't check if `args` is a tuple
还没有人认领这个 Issue。
- 主要语言
- Python
- 星标
- 77.2k
- 派生
- 35.9k
- PR 合并指标
- PR 指标待抓取
描述
Bug report
Bug description:
When load_reduce() is called in Python pickle, the args variable is pulled off the stack and passed into the functions using the * operator. This syntax is type-permissive, meaning the type can be any iterable that will return the needed arguments.
However, in C _pickle, argtup is pulled off the stack and passed into PyObject_CallObject(), which checks if the args parameter is specifically a PyTuple().
This means that any non-tuple iterator being used as the arguments passed into the function will cause C _pickle to throw an error, but Python pickle deserialization to unfold just fine.
payload: b'cbuiltins\nprint\n}R.'
pickle:
None
_pickle.c: FAILURE argument list must be a tuple
pickletools:
0: c GLOBAL 'builtins print'
16: } EMPTY_DICT
17: R REDUCE
18: . STOP
highest protocol among opcodes = 1
I think the easiest way to remedy the discrepancy is to explicitly type check the args parameter in pickle.py's load_reduce() function.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Linked PRs
- gh-144419
贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
调研方向
从 Lib/pickle.py 的 load_reduce() 开始,将其参数处理方式与 Modules/_pickle.c 以及 Objects/call.c 中所引用的 PyObject_CallObject() 行为进行比较。检查链接的 PR gh-144419 和现有的 pickle 测试;完成的标准是 Python pickle 和 _pickle 对所报告的非 tuple 参数情况进行一致处理。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- python
- 领域
- backend
- Issue 类型
- 缺陷
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 活跃度
- 停滞
- 描述清晰度
- 描述清楚
- 新手友好度
- 25/100