Skip to content

gh-161053: Fix out-of-bounds read in TextIOWrapper.tell() after seek() - #161054

Open
gpshead wants to merge 1 commit into
python:mainfrom
gpshead:scanfix-textio-vclyayc1
Open

gpshead wants to merge 1 commit into
python:mainfrom
gpshead:scanfix-textio-vclyayc1

Conversation

@gpshead

@gpshead gpshead commented Nov 1, 2026 •

Copy link
Copy Markdown
Member

Clamp the start guess in TextIOWrapper.tell() to the size of the decoder snapshot instead of only asserting it, in both the C and _pyio implementations. The guess is only the starting point of the search that follows, so the returned cookies do not change. seek() still keeps the bytes-per-character ratio of the previous chunk; with the clamp that only affects how quickly the search converges, so recomputing it is left out to keep the backport small.

Fixes #161053

ANT-2026-VCLYAYC1

… seek()

Clamp the bytes-per-character start guess in tell() to the size of the
decoder snapshot instead of only asserting it.
@gpshead gpshead added needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Nov 1, 2026
@gpshead gpshead self-assigned this Nov 1, 2026
@gpshead
gpshead requested a review from cmaloney November 1, 2026 02:21
@gpshead gpshead added stdlib Standard Library Python modules in the Lib/ directory extension-modules C modules in the Modules dir labels Nov 1, 2026
@gpshead
gpshead marked this pull request as ready for review November 1, 2026 02:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

awaiting core review extension-modules C modules in the Modules dir needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes stdlib Standard Library Python modules in the Lib/ directory

Projects

None yet

Development

Successfully merging this pull request may close these issues.

TextIOWrapper.tell() reads past the decoder snapshot after seek()

1 participant