gh-136053: Memory Safety Issue in marshal.c TYPE_SLICE Case

[akshat62]

• Issue: Memory Safety Issue in marshal.c TYPE_SLICE Case #136053

[picnixz]

cc @serhiy-storchaka

Would it be possible to add a test with a maliciously crafted data so that we ensure that the vulnerability can be exploited?

[picnixz]

Thanks for the fix but please add a regression test. Even if it's not easily reproducible, I'd like to see a PoC.

[serhiy-storchaka]

The test does not work.

For testing, you need to create at least 2147483646 (0x7ffffffe) references. This is impossible on 32-bit platform, and on 64-bit platforms it will consume at least 16 GiB (and maybe 32 GiB or 64 GiB due to overallocation) only for the list, not counting the referred objects. This is a bigmem test. This will also take a significant amount of time to run. I do not think it is worth to add an expensive test for trivial fix.

[serhiy-storchaka]

LGTM.