Potential integer overflows in Objects/abstract.c buffer copy APIs

Bug report

Bug description:

Bug report

Bug summary
While reviewing the Buffer API implementation in Objects/abstract.c, I noticed two potential integer overflow vulnerabilities explicitly marked with XXX comments by developers.

These overflows occur in PyObject_CopyData when dealing with multi-dimensional buffers. If a buffer with artificially large dimensions or shape is provided, it can cause integer wrapping, leading to undersized memory allocations or incorrect element counts.

Code snippets

1. Heap Buffer Overflow risk around line 721 in Objects/abstract.c:

    /* XXX(nnorwitz): need to check for overflow! */
    indices = (Py_ssize_t *)PyMem_Malloc(sizeof(Py_ssize_t)*view_src.ndim);

If view_src.ndim is large enough, sizeof(Py_ssize_t) * view_src.ndim will overflow, resulting in a tiny allocation. The subsequent initialization loop will write out of bounds.

2. Incorrect element count risk around line 734 in Objects/abstract.c:

    elements = 1;
    for (k=0; k<view_src.ndim; k++) {
        /* XXX(nnorwitz): can this overflow? */
        elements *= view_src.shape[k];
    }

If the dimensions in view_src.shape are large, multiplying them together can easily overflow the elements variable (a signed Py_ssize_t), resulting in a negative or truncated value, causing the subsequent while (elements--) loop to behave incorrectly.

Proposed Solution
Use standard overflow checking functions before performing the multiplications. For the allocation, consider using PyMem_New or PyMem_Malloc alongside an overflow check against PY_SSIZE_T_MAX.

CPython versions tested on:
Currently present on the main branch.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Windows

Linked PRs

• gh-153690

Objects/abstract.c の PyObject_CopyData から始め、レポートで特定されているインデックスの割り当てと多次元要素数のカウントループの周辺を確認してください。大きな次元または shape を持つバッファーで動作を再現し、その後、サイズが過大な入力によって不正な割り当てサイズや要素数が生成されなくなっていることを確認してください。issue ではリンクされた PR gh-153690 に言及しているため、まずその作業を確認してください。