Skip to content

Memory error in calendar.isleap #103687

Closed as not planned
Closed as not planned
@baltsers

Description

@baltsers

Bug report

We did a fuzzing test on Python3.9.15, a memory error happened.

from calendar import *
import calendar
import argparse

class demoCls():

    def __init__(self):
        pass

    def demoFunc(self, arg):
        try:
            ret = calendar.isleap(arg)
        except (AssertionError, AttributeError, LookupError, OSError, TypeError, ValueError, argparse.ArgumentError, argparse.ArgumentTypeError, calendar.IllegalMonthError, calendar.IllegalWeekdayError) as e:
            pass

year = b'%444444444444reduce_depth44444444444444444444444F'
dc = demoCls()
dc.demoFunc(year)

details

Bug info

    #1 0x499621 in PyMem_RawMalloc /root/CpyFuzz/experiments/Python-3.9.15/Objects/obmalloc.c:572:12
    #2 0x499621 in _PyObject_Malloc /root/CpyFuzz/experiments/Python-3.9.15/Objects/obmalloc.c:1645:11
    #3 0x41f83e in _PyBytes_FromSize /root/CpyFuzz/experiments/Python-3.9.15/Objects/bytesobject.c:81:31
    #4 0x41f83e in PyBytes_FromStringAndSize /root/CpyFuzz/experiments/Python-3.9.15/Objects/bytesobject.c:112:27
    #5 0x428506 in _PyBytesWriter_Resize /root/CpyFuzz/experiments/Python-3.9.15/Objects/bytesobject.c:3348:30
    #6 0x422faa in _PyBytesWriter_Prepare /root/CpyFuzz/experiments/Python-3.9.15/Objects/bytesobject.c:3401:15
    #7 0x422faa in _PyBytes_FormatEx /root/CpyFuzz/experiments/Python-3.9.15/Objects/bytesobject.c:962:23
    #8 0x6be614 in binary_op1 /root/CpyFuzz/experiments/Python-3.9.15/Objects/abstract.c:869:13
    #9 0x6bec07 in binary_op /root/CpyFuzz/experiments/Python-3.9.15/Objects/abstract.c:898:24
    #10 0x6bec07 in PyNumber_Remainder /root/CpyFuzz/experiments/Python-3.9.15/Objects/abstract.c:1086:12
    #11 0x55606a in _PyEval_EvalFrameDefault /root/CpyFuzz/experiments/Python-3.9.15/Python/ceval.c:1676:21
    #12 0x43336f in _PyEval_EvalFrame /root/CpyFuzz/experiments/Python-3.9.15/./Include/internal/pycore_ceval.h:40:12
    #13 0x43336f in function_code_fastcall /root/CpyFuzz/experiments/Python-3.9.15/Objects/call.c:330:24
    #14 0x5635fd in _PyObject_VectorcallTstate /root/CpyFuzz/experiments/Python-3.9.15/./Include/cpython/abstract.h:118:11
    #15 0x5635fd in PyObject_Vectorcall /root/CpyFuzz/experiments/Python-3.9.15/./Include/cpython/abstract.h:127:12
    #16 0x5635fd in call_function /root/CpyFuzz/experiments/Python-3.9.15/Python/ceval.c:5077:13
    #17 0x55d8bf in _PyEval_EvalFrameDefault /root/CpyFuzz/experiments/Python-3.9.15/Python/ceval.c:3489:23
    #18 0x43336f in _PyEval_EvalFrame /root/CpyFuzz/experiments/Python-3.9.15/./Include/internal/pycore_ceval.h:40:12
    #19 0x43336f in function_code_fastcall /root/CpyFuzz/experiments/Python-3.9.15/Objects/call.c:330:24
    #20 0x5635fd in _PyObject_VectorcallTstate /root/CpyFuzz/experiments/Python-3.9.15/./Include/cpython/abstract.h:118:11
    #21 0x5635fd in PyObject_Vectorcall /root/CpyFuzz/experiments/Python-3.9.15/./Include/cpython/abstract.h:127:12
    #22 0x5635fd in call_function /root/CpyFuzz/experiments/Python-3.9.15/Python/ceval.c:5077:13
    #23 0x55d897 in _PyEval_EvalFrameDefault /root/CpyFuzz/experiments/Python-3.9.15/Python/ceval.c:3506:23
    #24 0x565264 in _PyEval_EvalFrame /root/CpyFuzz/experiments/Python-3.9.15/./Include/internal/pycore_ceval.h:40:12
    #25 0x565264 in _PyEval_EvalCode /root/CpyFuzz/experiments/Python-3.9.15/Python/ceval.c:4329:14
    #26 0x554061 in _PyEval_EvalCodeWithName /root/CpyFuzz/experiments/Python-3.9.15/Python/ceval.c:4361:12
    #27 0x554061 in PyEval_EvalCodeEx /root/CpyFuzz/experiments/Python-3.9.15/Python/ceval.c:4377:12
    #28 0x554061 in PyEval_EvalCode /root/CpyFuzz/experiments/Python-3.9.15/Python/ceval.c:828:12
    #29 0x5d2367 in run_eval_code_obj /root/CpyFuzz/experiments/Python-3.9.15/Python/pythonrun.c:1221:9
    #30 0x5d2367 in run_mod /root/CpyFuzz/experiments/Python-3.9.15/Python/pythonrun.c:1242:19
    #31 0x5d2367 in pyrun_file /root/CpyFuzz/experiments/Python-3.9.15/Python/pythonrun.c:1140:15
    #32 0x5cedc6 in pyrun_simple_file /root/CpyFuzz/experiments/Python-3.9.15/Python/pythonrun.c:450:13
    #33 0x5cedc6 in PyRun_SimpleFileExFlags /root/CpyFuzz/experiments/Python-3.9.15/Python/pythonrun.c:483:15
    #34 0x41e1fd in pymain_run_file /root/CpyFuzz/experiments/Python-3.9.15/Modules/main.c:373:15
    #35 0x41e1fd in pymain_run_python /root/CpyFuzz/experiments/Python-3.9.15/Modules/main.c:598:21
    #36 0x41e1fd in Py_RunMain /root/CpyFuzz/experiments/Python-3.9.15/Modules/main.c:677:5
    #37 0x41ea66 in pymain_main /root/CpyFuzz/experiments/Python-3.9.15/Modules/main.c:707:12
    #38 0x41ead2 in Py_BytesMain /root/CpyFuzz/experiments/Python-3.9.15/Modules/main.c:731:12
    #39 0x7fa91a5bac86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86)

My environment

CPython: 3.9.15
Ubuntu: 18.0.4 (x86 64)

Metadata

Metadata

Assignees

No one assigned

    Labels

    type-bugAn unexpected behavior, bug, or errortype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions