gh-130775: Validate negative locations in ast

Author: sobolevn

Lib/test/test_ast/test_ast.py

@@ -204,6 +204,27 @@ def test_compilation_of_ast_nodes_with_default_end_position_values(self):
         # Check that compilation doesn't crash. Note: this may crash explicitly only on debug mode.
         compile(tree, "<string>", "exec")
 
+    def test_compilation_of_ast_nodes_with_negative_position_values(self):
+        # See https://github.com/python/cpython/issues/130775
+        alias = ast.alias(name='traceback', lineno=0, col_offset=0)
+        for attrs in (
+            {'lineno': -2, 'col_offset': 0},
+            {'lineno': 0, 'col_offset': -2},
+            {'lineno': 0, 'col_offset': -2, 'end_col_offset': -2},
+            {'lineno': -2, 'end_lineno': -2, 'col_offset': 0},
+        ):
+            with self.subTest(attrs=attrs):
+                tree = ast.Module(body=[
+                    ast.Import(names=[alias], **attrs)
+                ], type_ignores=[])
+
+                # It used to crash on this step:
+                with self.assertRaisesRegex(
+                    ValueError,
+                    'AST node has invalid location',
+                ):
+                    compile(tree, "<string>", "exec")
+
     def test_slice(self):
         slc = ast.parse("x[::]").body[0].value.slice
         self.assertIsNone(slc.upper)

Misc/NEWS.d/next/Core_and_Builtins/2025-03-03-20-02-45.gh-issue-130775.fEM6T-.rst

@@ -0,0 +1,2 @@
+Validate negative :mod:`ast` locations, we only allow ``-1`` as a special
+value.

Python/assemble.c

@@ -297,6 +297,7 @@ write_location_info_entry(struct assembler* a, location loc, int isize)
     int line_delta = loc.lineno - a->a_lineno;
     int column = loc.col_offset;
     int end_column = loc.end_col_offset;
+    // Values are validated in `VALIDATE_POSITIONS` in `ast.c`:
     assert(column >= -1);
     assert(end_column >= -1);
     if (column < 0 || end_column < 0) {

Python/ast.c

@@ -40,6 +40,14 @@ static int validate_typeparam(type_param_ty);
                      node->col_offset, node->end_col_offset, node->lineno, node->end_lineno); \
         return 0; \
     } \
+    if (node->lineno < -1 || node->end_lineno < -1 || \
+        node->col_offset < -1 || node->end_col_offset < -1) { \
+        PyErr_Format(PyExc_ValueError, \
+                     "AST node has invalid location (%d, %d, %d, %d)", \
+                     node->lineno, node->end_lineno, \
+                     node->col_offset, node->end_col_offset); \
+        return 0; \
+    } \
     if (node->lineno == node->end_lineno && node->col_offset > node->end_col_offset) { \
         PyErr_Format(PyExc_ValueError, \
                      "line %d, column %d-%d is not a valid range", \