map: Always hash the object in mp_map_lookup.

jepler · jepler · commit e4e97f5aa7d5 · 2025-07-20T06:14:30.000-05:00
Fuzzing produced a crash in OrderedDict which reduced to the
following:
```
from collections import OrderedDict
x = OrderedDict()
x[: 'a'] = 1
x['b'] = 2
```

This occurs because, as an optimization, the key is not hashed when
searching an OrderedDict, so an unhashable key can be stored. Even
worse, the slice in this case is from build_slice_stack_allocated
so by the time the 2nd indexing operation is being performed, it's
nonsense instead of a Python object.

The new test is in its own file because Python 3.12 actually
made slice objects hashable so a .exp file is required.

Signed-off-by: Jeff Epler &lt;jepler@gmail.com&gt;
diff --git a/py/map.c b/py/map.c
@@ -188,6 +188,16 @@ mp_map_elem_t *MICROPY_WRAP_MP_MAP_LOOKUP(mp_map_lookup)(mp_map_t * map, mp_obj_
         }
     }
 
+    // get hash of index, with fast path for common case of qstr
+    // The object is hashed regardless of whether the map is ordered or not,
+    // because performing the hash is also performing the "is object hashable" check.
+    mp_uint_t hash;
+    if (mp_obj_is_qstr(index)) {
+        hash = qstr_hash(MP_OBJ_QSTR_VALUE(index));
+    } else {
+        hash = MP_OBJ_SMALL_INT_VALUE(mp_unary_op(MP_UNARY_OP_HASH, index));
+    }
+
     // if the map is an ordered array then we must do a brute force linear search
     if (map->is_ordered) {
         for (mp_map_elem_t *elem = &map->table[0], *top = &map->table[map->used]; elem < top; elem++) {
@@ -241,14 +251,6 @@ mp_map_elem_t *MICROPY_WRAP_MP_MAP_LOOKUP(mp_map_lookup)(mp_map_t * map, mp_obj_
         }
     }
 
-    // get hash of index, with fast path for common case of qstr
-    mp_uint_t hash;
-    if (mp_obj_is_qstr(index)) {
-        hash = qstr_hash(MP_OBJ_QSTR_VALUE(index));
-    } else {
-        hash = MP_OBJ_SMALL_INT_VALUE(mp_unary_op(MP_UNARY_OP_HASH, index));
-    }
-
     size_t pos = hash % map->alloc;
     size_t start_pos = pos;
     mp_map_elem_t *avail_slot = NULL;
diff --git a/tests/basics/ordereddict_unhashable.py b/tests/basics/ordereddict_unhashable.py
@@ -0,0 +1,21 @@
+try:
+    from collections import OrderedDict
+except ImportError:
+    print("SKIP")
+    raise SystemExit
+
+d = OrderedDict()
+
+# ordered dict must reject nonhashable items, including slices
+# This test operates with a .exp file because Python 3.12 made slice objects
+# hashable.
+try:
+    d[:'a'] = 123
+except:
+    print("exception")
+
+try:
+    d[[]] = 123
+except:
+    print("exception")
+print(len(d))
diff --git a/tests/basics/ordereddict_unhashable.py.exp b/tests/basics/ordereddict_unhashable.py.exp
@@ -0,0 +1,3 @@
+exception
+exception
+0
