Skip to content

Validate datetime, UUID and parse mode integers before narrowing - #248

Merged
lelit merged 1 commit into
python-rapidjson:masterfrom
harbinresearcher:codex/validate-large-mode-flags
Oct 31, 2026
Merged

lelit merged 1 commit into
python-rapidjson:masterfrom
harbinresearcher:codex/validate-large-mode-flags

Conversation

@harbinresearcher

@harbinresearcher harbinresearcher commented Oct 14, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Keep the PyLong_AsLong() result as C long until the existing datetime/UUID/parse mode range checks finish. On LP64, narrowing it to int first lets values such as 2**32 or -(2**32) turn into a valid zero mode. The shared datetime validator now also takes long.

The runtime change consists of seven type substitutions; it retains valid mode behavior and existing error handling/messages. Add 90 regression cases through the existing string, binary-stream and text-stream fixtures, and a changelog entry. The unchanged Linux master fails 66 of those cases; the patched source passes all 90. On Windows the unchanged source already rejects them, so the new cases also pass before the patch.

Validation

  • Windows Python 3.12.14: baseline 1200 passed; patched 1290 passed.
  • Linux Python 3.12.15 and 3.14.8: baseline 1200 passed; patched 1290 passed.
  • Linux Python 3.10.22: baseline 1206 passed; patched 1296 passed.
  • All full suites have 17 skipped and 2 expected failures; the 3.12/3.14 suites also have one existing pytz deprecation warning.
  • stubtest rapidjson passes on Windows Python 3.12 and Linux Python 3.12/3.14.
  • Windows doctests: all 269 pass. Linux baseline and patch each fail the same one NM_NATIVE large-integer float-representation example (268/269 pass on 3.12, 273/274 on 3.14); its cause remains unverified.
  • Windows sdist/wheel build and an independently installed wheel smoke check succeed. Linux source builds use portable Zig 0.17.0 and a private LDCXXSHARED override because this environment has no system C++ compiler and Zig rejects this Python build's default --exclude-libs flag.
  • Read-only AI review found no actionable issue; no independent human review is claimed.

Hosted CI, debug Python, sanitizers, macOS and other wheel architectures are unverified. AI assistance was used for investigation, tests, implementation and review. This was found by source inspection, not a reported production incident.

Closes #247

GitHub Actions run 38505857785 currently has action_required: this first fork contribution awaits maintainer approval to run. CI is not yet verified.

@lelit
lelit merged commit e872b3e into python-rapidjson:master Oct 31, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Oversized datetime, UUID and parse modes are accepted after integer narrowing

2 participants