Skip to content

Commit 4a744bb

Browse files
committed
PoC: Adding test case
1 parent 8e1804d commit 4a744bb

1 file changed

Lines changed: 21 additions & 0 deletions

File tree

Lib/test/test_marshal.py

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -614,6 +614,27 @@ def test_slice(self):
614614
with self.assertRaises(ValueError):
615615
marshal.dumps(obj, version)
616616

617+
def test_slice_ref_reserve_failure(self):
618+
# Test for the fix: if (idx < 0) { break; }
619+
# This tests the case where r_ref_reserve fails when processing TYPE_SLICE with FLAG_REF
620+
# We simulate a scenario where the reference list is too large
621+
622+
# Create malformed marshal data: TYPE_SLICE with FLAG_REF but invalid reference handling
623+
# This should trigger the r_ref_reserve failure path and be handled gracefully
624+
malformed_data = b'\xba' # TYPE_SLICE | FLAG_REF (0x3a | 0x80)
625+
malformed_data += b'N' # None for start
626+
malformed_data += b'N' # None for stop
627+
malformed_data += b'N' # None for step
628+
629+
# This should raise an exception rather than crash
630+
with self.assertRaises((ValueError, EOFError)):
631+
marshal.loads(malformed_data)
632+
633+
# Test truncated data that would also trigger the error path
634+
truncated_data = b'\xba' + b'N' # TYPE_SLICE | FLAG_REF + only one component
635+
with self.assertRaises((ValueError, EOFError)):
636+
marshal.loads(truncated_data)
637+
617638
@support.cpython_only
618639
@unittest.skipUnless(_testcapi, 'requires _testcapi')
619640
class CAPI_TestCase(unittest.TestCase, HelperMixin):

0 commit comments

Comments
 (0)