map: Always hash the object in mp_map_lookup.

jepler · jepler · commit f9e60f81b358 · 2025-07-20T05:53:01.000-05:00
Fuzzing produced a crash in OrderedDict which reduced to the
following:
```
from collections import OrderedDict
x = OrderedDict()
x[: 'a'] = 1
x['b'] = 2
```

This occurs because, as an optimization, the key is not hashed when
searching an OrderedDict, so an unhashable key can be stored. Even
worse, the slice in this case is from build_slice_stack_allocated
so by the time the 2nd indexing operation is being performed, it's
nonsense instead of a Python object.

Signed-off-by: Jeff Epler &lt;jepler@gmail.com&gt;
diff --git a/py/map.c b/py/map.c
@@ -188,6 +188,16 @@ mp_map_elem_t *MICROPY_WRAP_MP_MAP_LOOKUP(mp_map_lookup)(mp_map_t * map, mp_obj_
         }
     }
 
+    // get hash of index, with fast path for common case of qstr
+    // The object is hashed regardless of whether the map is ordered or not,
+    // because performing the hash is also performing the "is object hashable" check.
+    mp_uint_t hash;
+    if (mp_obj_is_qstr(index)) {
+        hash = qstr_hash(MP_OBJ_QSTR_VALUE(index));
+    } else {
+        hash = MP_OBJ_SMALL_INT_VALUE(mp_unary_op(MP_UNARY_OP_HASH, index));
+    }
+
     // if the map is an ordered array then we must do a brute force linear search
     if (map->is_ordered) {
         for (mp_map_elem_t *elem = &map->table[0], *top = &map->table[map->used]; elem < top; elem++) {
@@ -241,14 +251,6 @@ mp_map_elem_t *MICROPY_WRAP_MP_MAP_LOOKUP(mp_map_lookup)(mp_map_t * map, mp_obj_
         }
     }
 
-    // get hash of index, with fast path for common case of qstr
-    mp_uint_t hash;
-    if (mp_obj_is_qstr(index)) {
-        hash = qstr_hash(MP_OBJ_QSTR_VALUE(index));
-    } else {
-        hash = MP_OBJ_SMALL_INT_VALUE(mp_unary_op(MP_UNARY_OP_HASH, index));
-    }
-
     size_t pos = hash % map->alloc;
     size_t start_pos = pos;
     mp_map_elem_t *avail_slot = NULL;
diff --git a/tests/basics/ordereddict1.py b/tests/basics/ordereddict1.py
@@ -41,3 +41,15 @@
     d.popitem()
 except:
     print('empty')
+
+# ordered dict must reject nonhashable items, including slices
+try:
+    d[:'a'] = 123
+except:
+    print("exception")
+
+try:
+    d[[]] = 123
+except:
+    print("exception")
+print(len(d))
