py/objdeque: Fix buffer overflow in deque_subscr.

jansturm92 · dpgeorge · commit a7d3bc23085f · 2024-11-18T23:27:13.000+11:00
In `deque_subscr()`, if `index_val` equals `self-&gt;alloc`, the index
correction `index_val -= self-&gt;alloc` does not execute, leading to an
out-of-bounds access in `self-&gt;items[index_val]`.

The fix in this commit ensures that the index correction is applied
whenever `index_val &gt;= self-&gt;alloc`, preventing access beyond the allocated
buffer size.

Signed-off-by: Jan Sturm &lt;jansturm92@googlemail.com&gt;
diff --git a/py/objdeque.c b/py/objdeque.c
@@ -208,7 +208,7 @@ static mp_obj_t deque_subscr(mp_obj_t self_in, mp_obj_t index, mp_obj_t value) {
 
     size_t offset = mp_get_index(self->base.type, deque_len(self), index, false);
     size_t index_val = self->i_get + offset;
-    if (index_val > self->alloc) {
+    if (index_val >= self->alloc) {
         index_val -= self->alloc;
     }
 

Original file line number	Diff line number	Diff line change
`@@ -208,7 +208,7 @@ static mp_obj_t deque_subscr(mp_obj_t self_in, mp_obj_t index, mp_obj_t value) {`
`208`	`208`
`209`	`209`	`size_t offset = mp_get_index(self->base.type, deque_len(self), index, false);`
`210`	`210`	`size_t index_val = self->i_get + offset;`
`211`		`- if (index_val > self->alloc) {`
	`211`	`+ if (index_val >= self->alloc) {`
`212`	`212`	`index_val -= self->alloc;`
`213`	`213`	`}`
`214`	`214`