Skip to content

bpo-29505: Fuzz ast.parse() / compile() with PyCF_ONLY_AST - #3437

Closed
ssbr wants to merge 2 commits into
python:mainfrom
ssbr:fuzz_ast
Closed

bpo-29505: Fuzz ast.parse() / compile() with PyCF_ONLY_AST#3437
ssbr wants to merge 2 commits into
python:mainfrom
ssbr:fuzz_ast

Conversation

@ssbr

@ssbrssbr commented Sep 7, 2017

Copy link
Copy Markdown
Contributor

ast.parse() just calls compile() with PyCF_ONLY_AST to exit early, so we emulate
that here with the call to the corresponding part of the C API.

https://bugs.python.org/issue29505

ast.parse() just calls compile() with PyCF_ONLY_AST to exit early, so we emulate
that here\ with the call to the corresponding part of the C API.
The code for compile() and Py_CompileStringObject() is duplicated, so
hypothetically one could have a bug and not the other, but... nah. :)
@benjaminp

Copy link
Copy Markdown
Contributor

This seems fine to me. We never actually got into oss-fuzz, though, right?

@terryjreedy

Copy link
Copy Markdown
Member

Devin, should this be closed, or did it fall through a crack?

@codecov

codecovBot commented Feb 28, 2020

Copy link
Copy Markdown

Codecov Report

Merging #3437 into master will decrease coverage by 1.66%.
The diff coverage is n/a.

Impacted file tree graph

@@ Coverage Diff @@## master #3437 +/- ##
===========================================
- Coverage 84.88% 83.22% -1.67% 
===========================================
Files 1801 1571 -230 Lines 524801 415192 -109609 Branches 0 44479 +44479 ===========================================
- Hits 445489 345526 -99963 + Misses 79312 60022 -19290 - Partials 0 9644 +9644 
Impacted FilesCoverage Δ
Lib/test/dis_module.py0.00% <0.00%> (-100.00%)⬇️
Lib/test/test_binhex.py13.33% <0.00%> (-83.45%)⬇️
Lib/binhex.py17.84% <0.00%> (-69.44%)⬇️
Lib/test/test_spwd.py25.00% <0.00%> (-65.17%)⬇️
Lib/sqlite3/dbapi2.py34.88% <0.00%> (-65.12%)⬇️
Lib/idlelib/autocomplete_w.py14.61% <0.00%> (-37.39%)⬇️
Lib/threading.py47.43% <0.00%> (-35.64%)⬇️
Lib/test/test_eintr.py58.33% <0.00%> (-33.34%)⬇️
Lib/distutils/tests/test_bdist_wininst.py60.00% <0.00%> (-33.34%)⬇️
Lib/test/test_tuple.py69.58% <0.00%> (-29.78%)⬇️
... and 1677 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 888bbdc...a78bd90. Read the comment docs.

@ammaraskar

Copy link
Copy Markdown
Member

Closing in favor of #28777, thank you again for your original work on this Devin.

miss-islington pushed a commit that referenced this pull request Oct 6, 2021
This supercedes #3437 and fuzzes the method we recommend for unsafe inputs, `ast.literal_eval`. This should exercise the tokenizer and parser.
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants

@ssbr@benjaminp@terryjreedy@ammaraskar@the-knights-who-say-ni@bedevere-bot