)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.
(cherry picked from commit 4135166)

Co-authored-by: Victor Stinner <vstinner@python.org>

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.
(cherry picked from commit 4135166)

Co-authored-by: Victor Stinner <vstinner@python.org>

)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.
(cherry picked from commit 4135166)

Co-authored-by: Victor Stinner <vstinner@python.org>

)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.
(cherry picked from commit 4135166)

Co-authored-by: Victor Stinner <vstinner@python.org>

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.
(cherry picked from commit 4135166)

Co-authored-by: Victor Stinner <vstinner@python.org>

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.
(cherry picked from commit 4135166)

Co-authored-by: Victor Stinner <vstinner@python.org>

…H-97575)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.
(cherry picked from commit 4135166)

Co-authored-by: Victor Stinner <vstinner@python.org>

…H-97574)

gh-96848: Fix -X int_max_str_digits option parsing (GH-96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.
(cherry picked from commit 4135166)

Co-authored-by: Victor Stinner <vstinner@python.org>

…7576)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.
(cherry picked from commit 4135166)

Co-authored-by: Victor Stinner <vstinner@python.org>

pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

pythongh-95778: CVE-2020-10735: Prevent DoS by very large int() (pythonGH-96504)

Converting between `int` and `str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now
raises a `ValueError` if the number of digits in string form is above a
limit to avoid potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the `Integer String Conversion Length
Limitation` documentation.  The default limit is 4300
digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat] with feedback
from Victor Stinner, Thomas Wouters, Steve Dower, Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas this
  version will never be released
* Only add _Py_global_config_int_max_str_digits global variable:
  Python 3.6 doesn't have PyConfig API (PEP 597) nor _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but only
  if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

pythongh-95778: Mention sys.set_int_max_str_digits() in error message (python#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (python#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

Unlimited size of integers allows DoS by excessively long
processing of large numbers.

>> n = 10**(10**7) ; s = str(n)

Converting between `int` and `str` in bases other than
2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such
as base 10 (decimal) now raises a `ValueError` if the
number of digits in string form is above a limit to avoid
potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment
variable, command line flag, or :mod:`sys` APIs. See the `Integer
String Conversion Length Limitation` documentation.  The default
limit is 4300 digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat]
with feedback from Victor Stinner, Thomas Wouters, Steve Dower,
Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas
  this version will never be released
* Only add _Py_global_config_int_max_str_digits global
  variable: Python 3.6 doesn't have PyConfig API (PEP 597) nor
  _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for
  that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but
  only if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

gh#95778: Mention sys.set_int_max_str_digits() in error message (gh#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (gh#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

Originally by Victor Stinner of Red Hat
gh#fedora-python/cpython@31cfb69

Fixes: bsc#1203125
Fixes: gh#fedora-python/cpython#96504
Patch: CVE-2020-10735-DoS-no-limit-int-size.patch

Unlimited size of integers allows DoS by excessively long
processing of large numbers.

>> n = 10**(10**7) ; s = str(n)

Converting between `int` and `str` in bases other than
2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such
as base 10 (decimal) now raises a `ValueError` if the
number of digits in string form is above a limit to avoid
potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment
variable, command line flag, or :mod:`sys` APIs. See the `Integer
String Conversion Length Limitation` documentation.  The default
limit is 4300 digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat]
with feedback from Victor Stinner, Thomas Wouters, Steve Dower,
Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas
  this version will never be released
* Only add _Py_global_config_int_max_str_digits global
  variable: Python 3.6 doesn't have PyConfig API (PEP 597) nor
  _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for
  that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but
  only if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

gh#95778: Mention sys.set_int_max_str_digits() in error message (gh#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (gh#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

Originally by Victor Stinner of Red Hat
gh#fedora-python/cpython@31cfb69

Fixes: bsc#1203125
Fixes: gh#fedora-python/cpython#96504
Patch: CVE-2020-10735-DoS-no-limit-int-size.patch

Unlimited size of integers allows DoS by excessively long
processing of large numbers.

>> n = 10**(10**7) ; s = str(n)

Converting between `int` and `str` in bases other than
2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such
as base 10 (decimal) now raises a `ValueError` if the
number of digits in string form is above a limit to avoid
potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment
variable, command line flag, or :mod:`sys` APIs. See the `Integer
String Conversion Length Limitation` documentation.  The default
limit is 4300 digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat]
with feedback from Victor Stinner, Thomas Wouters, Steve Dower,
Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas
  this version will never be released
* Only add _Py_global_config_int_max_str_digits global
  variable: Python 3.6 doesn't have PyConfig API (PEP 597) nor
  _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for
  that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but
  only if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

gh#95778: Mention sys.set_int_max_str_digits() in error message (gh#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (gh#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

Originally by Victor Stinner of Red Hat
gh#fedora-python/cpython@31cfb69

Fixes: bsc#1203125
Fixes: gh#fedora-python/cpython#96504
Patch: CVE-2020-10735-DoS-no-limit-int-size.patch

Unlimited size of integers allows DoS by excessively long
processing of large numbers.

>> n = 10**(10**7) ; s = str(n)

Converting between `int` and `str` in bases other than
2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such
as base 10 (decimal) now raises a `ValueError` if the
number of digits in string form is above a limit to avoid
potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment
variable, command line flag, or :mod:`sys` APIs. See the `Integer
String Conversion Length Limitation` documentation.  The default
limit is 4300 digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat]
with feedback from Victor Stinner, Thomas Wouters, Steve Dower,
Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas
  this version will never be released
* Only add _Py_global_config_int_max_str_digits global
  variable: Python 3.6 doesn't have PyConfig API (PEP 597) nor
  _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for
  that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but
  only if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

gh#95778: Mention sys.set_int_max_str_digits() in error message (gh#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (gh#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

Originally by Victor Stinner of Red Hat
gh#fedora-python/cpython@31cfb69

Fixes: bsc#1203125
Fixes: gh#fedora-python/cpython#96504
Patch: CVE-2020-10735-DoS-no-limit-int-size.patch

Unlimited size of integers allows DoS by excessively long
processing of large numbers.

>> n = 10**(10**7) ; s = str(n)

Converting between `int` and `str` in bases other than
2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such
as base 10 (decimal) now raises a `ValueError` if the
number of digits in string form is above a limit to avoid
potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment
variable, command line flag, or :mod:`sys` APIs. See the `Integer
String Conversion Length Limitation` documentation.  The default
limit is 4300 digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat]
with feedback from Victor Stinner, Thomas Wouters, Steve Dower,
Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas
  this version will never be released
* Only add _Py_global_config_int_max_str_digits global
  variable: Python 3.6 doesn't have PyConfig API (PEP 597) nor
  _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for
  that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but
  only if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

gh#95778: Mention sys.set_int_max_str_digits() in error message (gh#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (gh#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

Originally by Victor Stinner of Red Hat
gh#fedora-python/cpython@31cfb69

Fixes: bsc#1203125
Fixes: gh#fedora-python/cpython#96504
Patch: CVE-2020-10735-DoS-no-limit-int-size.patch

Unlimited size of integers allows DoS by excessively long
processing of large numbers.

>> n = 10**(10**7) ; s = str(n)

Converting between `int` and `str` in bases other than
2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such
as base 10 (decimal) now raises a `ValueError` if the
number of digits in string form is above a limit to avoid
potential denial of service attacks due to the algorithmic
complexity. This is a mitigation for CVE-2020-10735
(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735).

This new limit can be configured or disabled by environment
variable, command line flag, or :mod:`sys` APIs. See the `Integer
String Conversion Length Limitation` documentation.  The default
limit is 4300 digits in string form.

Patch by Gregory P. Smith [Google] and Christian Heimes [Red Hat]
with feedback from Victor Stinner, Thomas Wouters, Steve Dower,
Ned Deily, and Mark Dickinson.

Notes on the backport to Python 3.6:

* Use "Python 3.6.15-13" version in the documentation, whereas
  this version will never be released
* Only add _Py_global_config_int_max_str_digits global
  variable: Python 3.6 doesn't have PyConfig API (PEP 597) nor
  _PyRuntime.
* sys.flags.int_max_str_digits cannot be -1 on Python 3.6: it is
  set to the default limit. Adapt test_int_max_str_digits() for
  that.
* Declare _PY_LONG_DEFAULT_MAX_STR_DIGITS and
  _PY_LONG_MAX_STR_DIGITS_THRESHOLD macros in longobject.h but
  only if the Py_BUILD_CORE macro is defined.
* Declare _Py_global_config_int_max_str_digits in pydebug.h.

(cherry picked from commit 511ca94)

gh#95778: Mention sys.set_int_max_str_digits() in error message (gh#96874)

When ValueError is raised if an integer is larger than the limit,
mention sys.set_int_max_str_digits() in the error message.

(cherry picked from commit e841ffc)

pythongh-96848: Fix -X int_max_str_digits option parsing (gh#96988)

Fix command line parsing: reject "-X int_max_str_digits" option with
no value (invalid) when the PYTHONINTMAXSTRDIGITS environment
variable is set to a valid limit.

(cherry picked from commit 4135166)

Originally by Victor Stinner of Red Hat
gh#fedora-python/cpython@31cfb69

Fixes: bsc#1203125
Fixes: gh#fedora-python/cpython#96504
Patch: CVE-2020-10735-DoS-no-limit-int-size.patch