objint_mpz: Fix pow3(1,2,0). #17716

jepler · 2025-07-19T16:31:37Z

Summary

This finding is based on fuzzing micropython. I manually minimized the test case it provided.

Testing

A fuzzer found a crash in 3-arg pow where the 3rd argument was zero. I added a test case for it, and fixed it.

Trade-offs and Alternatives

I initially wanted to throw ZeroDivisionError and re-use the error string but I now throw ValueError with a string that matches CPython (3.11.2)

github-actions · 2025-07-19T16:40:28Z

Code size report:

   bare-arm:    +0 +0.000% 
minimal x86:    +0 +0.000% 
   unix x64:   +16 +0.002% standard
      stm32:   +16 +0.004% PYBV10
     mimxrt:    +8 +0.002% TEENSY40
        rp2:   +16 +0.002% RPI_PICO_W
       samd:    +8 +0.003% ADAFRUIT_ITSYBITSY_M4_EXPRESS
  qemu rv32:   +13 +0.003% VIRT_RV32

codecov · 2025-07-19T16:41:55Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.38%. Comparing base (ab620f4) to head (0b0802c).
Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #17716   +/-   ##
=======================================
  Coverage   98.38%   98.38%           
=======================================
  Files         171      171           
  Lines       22239    22240    +1     
=======================================
+ Hits        21880    21881    +1     
  Misses        359      359

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

AJMansfield · 2025-07-21T03:14:24Z

py/objint_mpz.c

@@ -364,6 +364,9 @@ mp_obj_t mp_obj_int_pow3(mp_obj_t base, mp_obj_t exponent,  mp_obj_t modulus) {
        mpz_t *lhs = mp_mpz_for_int(base,     &l_temp);
        mpz_t *rhs = mp_mpz_for_int(exponent, &r_temp);
        mpz_t *mod = mp_mpz_for_int(modulus,  &m_temp);
+        if (mpz_is_zero(mod)) {
+            mp_raise_msg(&mp_type_ZeroDivisionError, MP_ERROR_TEXT("divide by zero"));


If CPython raises a ValueError here, why mp_raise_msg(&mp_type_ZeroDivisionError instead of just mp_raise_ValueError(?

I changed it, including introducing a new MP_ERROR_TEXT.

AJMansfield · 2025-07-21T03:35:35Z

py/objint_mpz.c

@@ -364,6 +364,9 @@ mp_obj_t mp_obj_int_pow3(mp_obj_t base, mp_obj_t exponent,  mp_obj_t modulus) {
        mpz_t *lhs = mp_mpz_for_int(base,     &l_temp);
        mpz_t *rhs = mp_mpz_for_int(exponent, &r_temp);
        mpz_t *mod = mp_mpz_for_int(modulus,  &m_temp);
+        if (mpz_is_zero(mod)) {


This should be checked right after the typeerror check, rather than after it (potentially) already allocated memory for the mpz buffers for its arguments.

Note that integer 0 is never a concrete object when represented as a mp_obj_t, it's always a small int --- so the condition to check for zero is just mp_obj_is_small_int(modulus) && MP_OBJ_SMALL_INT_VALUE(modulus) == 0

Makes sense, done.

Thinking about this led to the discovery of #17730.

AJMansfield · 2025-07-21T13:24:19Z

py/objint_mpz.c

    } else {
-        mp_obj_t result = mp_obj_new_int_from_ull(0); // Use the _from_ull version as this forces an mpz int
-        mp_obj_int_t *res_p = (mp_obj_int_t *)MP_OBJ_TO_PTR(result);
+        if (modulus == MP_OBJ_NEW_SMALL_INT(0)) {


De-nest this so it's parallel as an else if with the line above.

AJMansfield · 2025-07-21T13:30:43Z

py/objint_mpz.c

-        mp_obj_t result = mp_obj_new_int_from_ull(0); // Use the _from_ull version as this forces an mpz int
-        mp_obj_int_t *res_p = (mp_obj_int_t *)MP_OBJ_TO_PTR(result);
+        if (modulus == MP_OBJ_NEW_SMALL_INT(0)) {
+            mp_raise_msg(&mp_type_ValueError, MP_ERROR_TEXT("pow() 3rd argument cannot be 0"));


Use mp_raise_ValueError for smaller code size, that's the whole reason those shortcut raise methods exist.

done, thanks.

AJMansfield

Looks good! The tests seem adequate for the change, and I've confirmed sensitivity with unix-standard: tests correctly fail on b12af7d and pass on 902411a.

Unless someone else has a concern, this PR is ready to merge from f7d26f1.

jepler · 2025-07-22T01:14:26Z

Something must be wrong with the change, rv32 failed (timeout) specifically on basics_builtin_pow3_intbig. I can't figure why, and I failed at performing the rv32 build locally on my debian bookworm system to reproduce it here.

dpgeorge · 2025-07-22T02:32:31Z

I ran the rv32 tests locally with this PR, and did not get any failure. That basics_builtin_pow3_intbig test takes only a few seconds to run. I'm using newlib though, so maybe that's the difference?

AJMansfield · 2025-07-22T15:16:54Z

I'll see if I can corroborate whether or not it works on my Pico2 in Hazard3 mode.

AJMansfield · 2025-07-23T02:24:06Z

Can confirm that the tests pass on my Pico2 running in Hazard3 mode, not sure what the cause for the failure in qemu rv32 might be.

dpgeorge · 2025-07-25T01:14:01Z

I suggest rebasing this on latest master to see if it fixes the CI.

jepler · 2025-07-25T02:00:57Z

Done.

dpgeorge · 2025-07-25T02:41:32Z

CI now passing.

dpgeorge · 2025-07-25T02:43:04Z

py/objint_mpz.c

@@ -356,9 +356,10 @@ static mpz_t *mp_mpz_for_int(mp_obj_t arg, mpz_t *temp) {
 mp_obj_t mp_obj_int_pow3(mp_obj_t base, mp_obj_t exponent,  mp_obj_t modulus) {
    if (!mp_obj_is_int(base) || !mp_obj_is_int(exponent) || !mp_obj_is_int(modulus)) {
        mp_raise_TypeError(MP_ERROR_TEXT("pow() with 3 arguments requires integers"));
+    } else if (modulus == MP_OBJ_NEW_SMALL_INT(0)) {
+        mp_raise_ValueError(MP_ERROR_TEXT("pow() 3rd argument cannot be 0"));


This new error string adds quite a bit of code size, for arguably not much gain.

Suggest making it smaller, maybe reuse the divide-by-zero message "divide by zero" but keep it as a ValueError?

done.

Traceback (most recent call last): File "<stdin>", line 1, in <module> ZeroDivisionError: divide by zero >>> pow(1,1,0) Traceback (most recent call last): File "<stdin>", line 1, in <module> ValueError: divide by zero

Thanks. That's a much more acceptable code-size increase now.

This finding is based on fuzzing micropython. I manually minimized the test case it provided. Signed-off-by: Jeff Epler <jepler@gmail.com>

dpgeorge added the py-core Relates to py/ directory in source label Jul 20, 2025

AJMansfield reviewed Jul 21, 2025

View reviewed changes

AJMansfield suggested changes Jul 21, 2025

View reviewed changes

jepler mentioned this pull request Jul 21, 2025

code paths that return large ints where small ints would suffice #17730

Open

jepler force-pushed the pow3-assert-fail branch 3 times, most recently from 8b4de89 to 4c4582b Compare July 21, 2025 13:17

AJMansfield suggested changes Jul 21, 2025

View reviewed changes

jepler force-pushed the pow3-assert-fail branch 2 times, most recently from d213a53 to f7d26f1 Compare July 21, 2025 15:17

AJMansfield approved these changes Jul 21, 2025

View reviewed changes

AJMansfield mentioned this pull request Jul 23, 2025

tests/extmod/select_poll_eintr: Skip unreliable test in Github CI. #17745

Closed

jepler force-pushed the pow3-assert-fail branch from f7d26f1 to f4bd646 Compare July 25, 2025 02:00

dpgeorge reviewed Jul 25, 2025

View reviewed changes

objint_mpz: Fix pow3(1,2,0).

0b0802c

This finding is based on fuzzing micropython. I manually minimized the test case it provided. Signed-off-by: Jeff Epler <jepler@gmail.com>

jepler force-pushed the pow3-assert-fail branch from f4bd646 to 0b0802c Compare July 25, 2025 11:31

Uh oh!

objint_mpz: Fix pow3(1,2,0). #17716

Are you sure you want to change the base?

objint_mpz: Fix pow3(1,2,0). #17716

Conversation

jepler commented Jul 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Trade-offs and Alternatives

Uh oh!

github-actions bot commented Jul 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Jul 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AJMansfield Jul 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AJMansfield left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jepler commented Jul 22, 2025

Uh oh!

dpgeorge commented Jul 22, 2025

Uh oh!

AJMansfield commented Jul 22, 2025

Uh oh!

AJMansfield commented Jul 23, 2025

Uh oh!

dpgeorge commented Jul 25, 2025

Uh oh!

jepler commented Jul 25, 2025

Uh oh!

dpgeorge commented Jul 25, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

jepler commented Jul 19, 2025 •

edited

Loading

github-actions bot commented Jul 19, 2025 •

edited

Loading

codecov bot commented Jul 19, 2025 •

edited

Loading

AJMansfield Jul 21, 2025 •

edited

Loading

AJMansfield left a comment •

edited

Loading