Fix cyclic AST recursion DoS (issue #196) #213
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Adds new subcommands to expose PyTorchModelWrapper and polyglot module functionality via the CLI while maintaining full backward compatibility. New commands: - fickling pytorch identify FILE - Detect PyTorch format(s) - fickling pytorch show FILE - Decompile internal pickle - fickling pytorch check-safety FILE - Safety check internal pickle - fickling pytorch inject FILE ... - Inject payload into model - fickling polyglot identify FILE - Identify all possible formats - fickling polyglot properties FILE - File property analysis - fickling polyglot create F1 F2 -o O - Create polyglot file All commands support --json output and gracefully handle missing torch dependency with helpful installation instructions. Closes #101 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replace nested subcommands (pytorch/polyglot) with flat, auto-detecting commands: - fickling check FILE: Safety check any pickle/model (auto-detects format) - fickling inject FILE -c CODE -o OUT: Inject payload into any format - fickling info FILE: Show format and properties - fickling create-polyglot F1 F2 -o OUT: Create polyglot files Key changes: - Add auto_load() to loader.py for automatic format detection - Rewrite cli.py with flat command structure - Delete cli_pytorch.py and cli_polyglot.py (absorbed into cli.py) - Maintain full backward compatibility with legacy flags - Update tests for new interface The tool now figures out if input is PyTorch, TorchScript, plain pickle, etc. without users needing to specify format explicitly. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Cyclic pickle structures (e.g., `L = []; L.append(L)`) caused RecursionError when fickling analyzed them. This fix detects cycles at mutation points (Append, Appends, SetItem, SetItems, AddItems) and replaces self-references with `<cyclic-ref>` placeholder AST nodes. Changes: - Add `_has_cycle` flag to Interpreter to track cycle detection - Modify mutation operations to check if value being added `is` the container - Add `has_cycles` property to Pickled class for downstream awareness - Update tests to verify the fix works correctly Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This reverts commit 313981c.
This reverts commit 1f63c45.
This was erroneously added and later removed in PR #210. The visitor override tracks visited nodes by id to prevent infinite recursion when traversing cyclic AST structures created via MEMOIZE + GET opcodes. Co-Authored-By: Dan Guido <dan@trailofbits.com> Co-Authored-By: Claude Code <noreply@anthropic.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
L = []; L.append(L))<cyclic-ref>placeholder AST nodeshas_cyclesproperty toPickledclass for downstream awarenessFixes #196
Test plan
test_cyclic_pickle_dospasses (previously marked as expected failure)test_cyclic_pickle_creates_placeholderverifies placeholder is created🤖 Generated with Claude Code