Skip to content

gh-145792: Fix incorrect alloca allocation size in traceback.c#145814

Open
VanshAgarwal24036 wants to merge 3 commits intopython:mainfrom
VanshAgarwal24036:gh-145792-fix-traceback-alloca
Open

gh-145792: Fix incorrect alloca allocation size in traceback.c#145814
VanshAgarwal24036 wants to merge 3 commits intopython:mainfrom
VanshAgarwal24036:gh-145792-fix-traceback-alloca

Conversation

@VanshAgarwal24036
Copy link
Contributor

@VanshAgarwal24036 VanshAgarwal24036 commented Mar 11, 2026

Fix incorrect memory allocation when using the VLA fallback macro in traceback.c with alloca(). The previous implementation allocated only size bytes instead of sizeof(type) * size, which could lead to out-of-bounds access.

A regression test and NEWS entry are included.

@VanshAgarwal24036
Copy link
Contributor Author

@vstinner Please review it when you are free.

Copy link
Member

@vstinner vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

try:
recurse(50)
except RuntimeError as exc:
tb = traceback.format_exception(exc)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test is unrelated to the fix, I suggest removing it. I tried to write a test using faulthandler.dump_c_stack() but I don't know how to create a long C stack. The Python recurse() reuses the same _PyEval_EvalFrameDefault frame for the 50 calls.

Comment on lines +1 to +2
Fix incorrect memory allocation in the VLA fallback macro in traceback.c
when using alloca(), preventing potential out-of-bounds access.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Fix incorrect memory allocation in the VLA fallback macro in traceback.c
when using alloca(), preventing potential out-of-bounds access.
Fix incorrect memory allocation in the ``VLA()`` macro in ``traceback.c``
when using ``alloca()``, preventing potential stack overflow.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants