Potential integer overflows in Objects/abstract.c buffer copy APIs

Bug report

Bug description:

Bug report

Bug summary
While reviewing the Buffer API implementation in Objects/abstract.c, I noticed two potential integer overflow vulnerabilities explicitly marked with XXX comments by developers.

These overflows occur in PyObject_CopyData when dealing with multi-dimensional buffers. If a buffer with artificially large dimensions or shape is provided, it can cause integer wrapping, leading to undersized memory allocations or incorrect element counts.

Code snippets

1. Heap Buffer Overflow risk around line 721 in Objects/abstract.c:

    /* XXX(nnorwitz): need to check for overflow! */
    indices = (Py_ssize_t *)PyMem_Malloc(sizeof(Py_ssize_t)*view_src.ndim);

If view_src.ndim is large enough, sizeof(Py_ssize_t) * view_src.ndim will overflow, resulting in a tiny allocation. The subsequent initialization loop will write out of bounds.

2. Incorrect element count risk around line 734 in Objects/abstract.c:

    elements = 1;
    for (k=0; k<view_src.ndim; k++) {
        /* XXX(nnorwitz): can this overflow? */
        elements *= view_src.shape[k];
    }

If the dimensions in view_src.shape are large, multiplying them together can easily overflow the elements variable (a signed Py_ssize_t), resulting in a negative or truncated value, causing the subsequent while (elements--) loop to behave incorrectly.

Proposed Solution
Use standard overflow checking functions before performing the multiplications. For the allocation, consider using PyMem_New or PyMem_Malloc alongside an overflow check against PY_SSIZE_T_MAX.

CPython versions tested on:
Currently present on the main branch.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Windows

Linked PRs

• gh-153690

Beginne in Objects/abstract.c bei PyObject_CopyData, ungefähr bei der im Bericht identifizierten Indizes-Allokation und der Schleife zur Zählung multidimensionaler Elemente. Reproduziere das Verhalten mit Puffern mit großen Dimensionen oder Shapes und überprüfe anschließend, dass übergroße Eingaben nicht mehr zu falschen Allokationsgrößen oder Elementanzahlen führen; im Issue wird auf den verknüpften PR gh-153690 hingewiesen, also prüfe zuerst diese Arbeit.