Path: ...!news.mixmin.net!news.swapon.de!fu-berlin.de!uni-berlin.de!not-for-mail
From: Oscar Benjamin <oscar.j.benjamin@gmail.com>
Newsgroups: comp.lang.python
Subject: Re: Lengthy numbers
Date: Sun, 22 Dec 2024 23:32:30 +0000
Lines: 44
Message-ID: <mailman.14.1734910364.2912.python-list@python.org>
References: <eXx9P.64901$o72.28550@fx01.ams4>
 <CAHVvXxRQBUhFxdKKUGvR8BAeCmi0p-YZvoD_xdXuusFqcDjdjQ@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
X-Trace: news.uni-berlin.de UObgpSVC3U+Axn4eVOWxXQR0yV3aE7Rm4frTtdjFNRlg==
Cancel-Lock: sha1:xtnJlFRLaiiAXBujzfFUfwxoaJY= sha256:xPoU0rsrGHlB81eVsjznJezibX0mvYraCXjio0MEV3s=
Return-Path: <oscar.j.benjamin@gmail.com>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
Authentication-Results: mail.python.org; dkim=pass
 reason="2048-bit key; unprotected key"
 header.d=gmail.com header.i=@gmail.com header.b=kCiNCd93;
 dkim-adsp=pass; dkim-atps=neutral
X-Spam-Status: OK 0.001
X-Spam-Evidence: '*H*': 1.00; '*S*': 0.00; 'traceback': 0.04; '(most':
 0.05; 'last):': 0.05; 'e.g.': 0.07; 'string': 0.07; 'sun,': 0.07;
 'url-ip:184.105.99/24': 0.07; 'url-ip:184.105/16': 0.07;
 'enough.': 0.09; 'int': 0.09; 'skip:x 10': 0.09;
 'subject:numbers': 0.09; 'url-ip:184.105.99.75/32': 0.09;
 'url:discuss': 0.09; 'valueerror:': 0.09; 'conversion': 0.16;
 'cpython': 0.16; 'cpython.': 0.16; 'integer': 0.16; 'parsing':
 0.16; 'reminded': 0.16; 'slow': 0.16; 'slowness': 0.16; 'wrote:':
 0.16; 'problem': 0.16; 'solve': 0.19; 'to:addr:python-list': 0.20;
 'issue': 0.21; 'machine': 0.22; "i've": 0.22; 'i.e.': 0.22; 'run':
 0.23; '>>>': 0.28; 'etc': 0.28; 'think': 0.29; 'before.': 0.31;
 'dec': 0.31; 'message-id:@mail.gmail.com': 0.31; "doesn't": 0.32;
 '"",': 0.32; '(as': 0.32; 'concern': 0.32; 'python-list': 0.32;
 'but': 0.32; 'header:In-Reply-To:1': 0.34; 'received:google.com':
 0.34; 'same': 0.34; 'from:addr:gmail.com': 0.34; 'computer.':
 0.35; 'possibly': 0.36; 'people': 0.36; 'using': 0.37; 'hard':
 0.37; 'file': 0.38; 'use': 0.39; 'something': 0.40; 'want': 0.40;
 'likely': 0.61; 'seen': 0.62; 'come': 0.62; 'security': 0.64;
 'your': 0.64; 'becomes': 0.64; 'mainly': 0.64; 'numbers': 0.67;
 'playing': 0.69; 'url:t': 0.73; '....': 0.76; 'stumbled': 0.76;
 'quick': 0.77; 'dangerous': 0.81; 'motivated': 0.84; 'oscar':
 0.84; 'type.': 0.84
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=gmail.com; s=20230601; t=1734910361; x=1735515161; darn=python.org;
 h=to:subject:message-id:date:from:in-reply-to:references:mime-version
 :from:to:cc:subject:date:message-id:reply-to;
 bh=ES63BYC3cWlELxCHvKqK6HWzfEgSvS9Ums3g8dN5W3c=;
 b=kCiNCd93U2j7Gkjvb9e4st80lOKUsdyh7mt0MyRgkWYG8VJht8KzjbVAqf/Hi6wHu0
 HQG7sR3/MoKr2wbPUS3w0Ev/k/HokMfH1L+VgjcyviA03dIRLhl4DChzLsWY7o1AP+ln
 G4Q7x6xFfFwDoGteH1JSuAfBZuzUvcnLiA62JweonNixzJs3l+VnjRl7jICLTwod0C88
 X7FNtoD50CK4fAcD7h4XmF3JNgnP4bJSKC/AtDRq5kHAYYN3PUl5nL4rEWrX2t5P531x
 qTaS4DzS3CdUzSb17zB3Ek3u3zHa0sjLiXj46GsgwCi5wCqSSMJFfXmVw0wGpst6Q6sU
 /52A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1734910361; x=1735515161;
 h=to:subject:message-id:date:from:in-reply-to:references:mime-version
 :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
 bh=ES63BYC3cWlELxCHvKqK6HWzfEgSvS9Ums3g8dN5W3c=;
 b=U/QmQl8Fl9biYfOrF1B8gBFfR60FYgPdYK3wuSaWGQtsbSzv1ZpXpjkryoxLFaRsSb
 8cSBfrxeYpzHHH5O5SJY8+yFx5bEpylkqxAbCH1VLowNPQHbNIJnLzcV5xAXqa3f0EMQ
 2Z9xLh4gphDchiw6zKCcxqGr1ImMpSsHTaUfc4YmA2xqKe1TvOll8jYt4aJfUDfsTLD5
 dE4dF+InFj8VLogXYtzWnY33JXAwzJSPWcKuhlyKvk3J7N0dJDoYdpjGcGy3nWvHsrGz
 qvfe/Hn2hDqRLryaupWmWcjc6NyxLKI4Jl0IrBQg0s57LV8Bwk0mi2lVQ3DWr0RzJ7hD
 QWCA==
X-Gm-Message-State: AOJu0Yw7UPmz7U1DDR4WNYA8A+J1TzswlH5cXPmxRSZZbhXK2OldySLI
 /LAplhxoxu4T0BoZ8cTW9X5PJv/v28jhlJjIinwU0wU0mMcmp9Pe4SKBXauLhvuwLCjy3nRaf/R
 vuw8/O2p/hz58M22leoieFRvbqty+mXwV
X-Gm-Gg: ASbGncu09McW94J3WmgDv7gWMR0SNWuJt0enxUELk0g/u+z80QGCTv4126Ua+XMnWIR
 bFvQwAH5z8ksAMgsLe271wEVRjyxBcqPxi9xwBwxOFdBHTnfXCXmxmaWL/SR9fJ+cPjeFcGhD
X-Google-Smtp-Source: AGHT+IEVaUW4KSTQ9UD8jxcDHcMvTbd6hsRIaMQWpf4D0saZIoGgZiC1dSZiE23TjhplFjDUt4ei3AUXAfifAStsZPM=
X-Received: by 2002:a05:6870:9c88:b0:29e:27b6:bea5 with SMTP id
 586e51a60fabf-2a7fb1af4cemr5957772fac.25.1734910361480; Sun, 22 Dec 2024
 15:32:41 -0800 (PST)
In-Reply-To: <eXx9P.64901$o72.28550@fx01.ams4>
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: General discussion list for the Python programming language
 <python-list.python.org>
List-Unsubscribe: <https://mail.python.org/mailman/options/python-list>,
 <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <https://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <https://mail.python.org/mailman/listinfo/python-list>,
 <mailto:python-list-request@python.org?subject=subscribe>
X-Mailman-Original-Message-ID: <CAHVvXxRQBUhFxdKKUGvR8BAeCmi0p-YZvoD_xdXuusFqcDjdjQ@mail.gmail.com>
X-Mailman-Original-References: <eXx9P.64901$o72.28550@fx01.ams4>
Bytes: 7094

On Sun, 22 Dec 2024 at 19:17, Gilmeh Serda via Python-list
<python-list@python.org> wrote:
>
> Was just playing with numbers and stumbled on something I've never seen
> before.
....
>
> >>> 9**9**4
> Traceback (most recent call last):
>   File "<stdin>", line 1, in <module>
> ValueError: Exceeds the limit (4300 digits) for integer string conversion;
> use sys.set_int_max_str_digits() to increase the limit
>
> Explanation:
> https://discuss.python.org/t/int-str-conversions-broken-in-latest-python-bugfix-releases/18889

I think that the original security concern was mainly motivated by the
string to int direction i.e. calling int(s) for a possibly large
string s (possibly from an untrusted source) might be slow with
CPython. To solve that problem conversions from string->int and
int->string were disallowed. Now that more time has passed it becomes
clearer that disabling int->string conversion is more likely to be the
thing that people bump into as a result of this limitation (as you
just did). I find it harder to see what the security problem is in
that direction but I don't think this will be changed.

CPython has an implementation of arbitrarily large integers but an
important part of it is hobbled. If you do want to work with such
large integers then I recommend using either gmpy2's gmpy2.mpz type or
python-flint's flint.fmpz type.

At the same time it is not hard to run into slowness with integers
e.g. 10**10**10 but that won't come up in string parsing if not using
eval. Not a likely security issue but I am suddenly reminded of this
dangerous snippet:

  x = [0]; x.extend(iter(x))

If you want to test it then make sure to save your work etc and be
prepared to hard reset the computer. On this machine Ctrl-C doesn't
work for this but Ctrl-\ does if you do it quick enough.

--
Oscar