recmo · prestwich · May 21, 2025 · May 21, 2025 · May 21, 2025 · May 21, 2025
@@ -9,6 +9,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+### Changed
+
+- Updated Pyo3. This is a **non-semver breaking change** to address a vulnerability reported on Pyo3. ([#460])
+
+### Fixed
+
+
 ## [1.14.0] - 2025-03-25
 
 ### Added

@@ -69,7 +69,7 @@ primitive-types = { version = "0.12", optional = true, default-features = false
 proptest = { version = "1", optional = true, default-features = false, features = [
     "no_std",
 ] }
-pyo3 = { version = "0.19", optional = true, default-features = false }
+pyo3 = { version = "0.25", optional = true, default-features = false }
 quickcheck = { version = "1", optional = true, default-features = false }
 rand-08 = { version = "0.8", package = "rand", optional = true, default-features = false }
 rand-09 = { version = "0.9", package = "rand", optional = true, default-features = false }

@@ -149,7 +149,7 @@ named feature flag.
   `sqlx` to be used with the `tokio-native-tls` runtime, due to issue [sqlx#1627](https://github.com/launchbadge/sqlx/issues/1627).
 * [`zeroize`](https://docs.rs/zeroize): Implements the [`Zeroize`](https://docs.rs/zeroize/latest/zeroize/trait.Zeroize.html) trait. This makes [`Uint`] and [`Bits`] compatible with the [`secrecy`](https://crates.io/crates/secrecy) crate.
 * [`valuable`](https://docs.rs/valuable): Implements the [`Valuable`](https://docs.rs/valuable/0.1.0/valuable/trait.Valuable.html) trait.
-* [`pyo3`](https://docs.rs/pyo3): Implements the [`ToPyObject`](https://docs.rs/pyo3/latest/pyo3/conversion/trait.ToPyObject.html), [`IntoPy`](https://docs.rs/pyo3/latest/pyo3/conversion/trait.IntoPy.html) and [`FromPyObject`](https://docs.rs/pyo3/latest/pyo3/conversion/trait.FromPyObject.html) traits.
+* [`pyo3`](https://docs.rs/pyo3): Implements the [`IntoPyObject`](https://docs.rs/pyo3/latest/pyo3/conversion/trait.IntoPyObject.html) and [`FromPyObject`](https://docs.rs/pyo3/latest/pyo3/conversion/trait.FromPyObject.html) traits.
 * [`parity-scale-codec`](https://docs.rs/parity-scale-codec): Implements the [`Encode`](https://docs.rs/parity-scale-codec/latest/parity_scale_codec/trait.Encode.html), [`Decode`](https://docs.rs/parity-scale-codec/latest/parity_scale_codec/trait.Decode.html), [`MaxEncodedLen`](https://github.com/paritytech/parity-scale-codec/blob/47d98a1c23dabc890fdb548d115a18070082c66e/src/max_encoded_len.rs) and [`HasCompact`](https://docs.rs/parity-scale-codec/latest/parity_scale_codec/trait.HasCompact.html) traits.
 * [`bn-rs`](https://docs.rs/bn-rs/latest/bn_rs/): Implements conversion to/from the [`BN`](https://docs.rs/bn-rs/latest/bn_rs/struct.BN.html) and [`BigNumber`](https://docs.rs/bn-rs/latest/bn_rs/struct.BigNumber.html).
 * [`bytemuck`](https://docs.rs/bytemuck): Implements the [`Pod`](https://docs.rs/bytemuck/latest/bytemuck/trait.Pod.html) and [`Zeroable`](https://docs.rs/bytemuck/latest/bytemuck/trait.Zeroable.html) traits for [`Uint`] where the size is a multiple of 64, up to 1024. This allows `Uint` to be used where a `Pod` trait bound exists.

@@ -24,43 +24,54 @@
 #![cfg_attr(docsrs, doc(cfg(feature = "pyo3")))]
 
 use crate::Uint;
-use core::ffi::c_uchar;
 use pyo3::{
-    exceptions::PyOverflowError, ffi, AsPyPointer, FromPyObject, IntoPy, PyAny, PyErr, PyObject,
-    PyResult, Python, ToPyObject,
+    exceptions::PyOverflowError,
+    ffi,
+    types::{PyAnyMethods, PyInt},
+    Bound, FromPyObject, IntoPyObject, PyAny, PyErr, PyResult, Python,
 };
 
-impl<const BITS: usize, const LIMBS: usize> ToPyObject for Uint<BITS, LIMBS> {
-    fn to_object(&self, py: Python<'_>) -> PyObject {
+// This implementation via &Self mirrors the implementations for biguint in
+// pyo3.
+impl<'a, const BITS: usize, const LIMBS: usize> IntoPyObject<'a> for Uint<BITS, LIMBS> {
+    type Target = PyInt;
+
+    type Output = Bound<'a, Self::Target>;
+
+    type Error = PyErr;
+
+    fn into_pyobject(self, py: Python<'a>) -> Result<Self::Output, Self::Error> {
+        (&self).into_pyobject(py)
+    }
+}
+
+impl<'a, const BITS: usize, const LIMBS: usize> IntoPyObject<'a> for &Uint<BITS, LIMBS> {
+    type Target = PyInt;
+    type Output = Bound<'a, Self::Target>;
+    type Error = PyErr;
+
+    fn into_pyobject(self, py: Python<'a>) -> Result<Self::Output, Self::Error> {
         // Fast path for small ints
         if BITS <= 64 {
             let value = self.as_limbs().first().copied().unwrap_or(0);
-            return unsafe {
-                let obj = ffi::PyLong_FromUnsignedLongLong(value);
-                assert!(!obj.is_null(), "Out of memory");
-                PyObject::from_owned_ptr(py, obj)
-            };
+            return Ok(value.into_pyobject(py).unwrap());
         }
 
         // Convert using little endian bytes (trivial on LE archs)
         // and `_PyLong_FromByteArray`.
         let bytes = self.as_le_bytes();
+
         unsafe {
             let obj =
-                ffi::_PyLong_FromByteArray(bytes.as_ptr().cast::<c_uchar>(), bytes.len(), 1, 0);
-            PyObject::from_owned_ptr(py, obj)
+                ffi::_PyLong_FromByteArray(bytes.as_ptr().cast(), bytes.len(), 1, false.into());
+            let bound = Bound::from_owned_ptr(py, obj);
+            Ok(bound.downcast_into_unchecked())
         }
     }
 }
 
-impl<const BITS: usize, const LIMBS: usize> IntoPy<PyObject> for Uint<BITS, LIMBS> {
-    fn into_py(self, py: Python<'_>) -> PyObject {
-        self.to_object(py)
-    }
-}
-
-impl<'source, const BITS: usize, const LIMBS: usize> FromPyObject<'source> for Uint<BITS, LIMBS> {
-    fn extract(ob: &'source PyAny) -> PyResult<Self> {
+impl<'a, const BITS: usize, const LIMBS: usize> FromPyObject<'a> for Uint<BITS, LIMBS> {
+    fn extract_bound(ob: &Bound<'a, PyAny>) -> PyResult<Self> {
         let mut result = Self::ZERO;
 
         // On little endian let Python write directly to the uint.
@@ -134,8 +145,8 @@ mod test {
                 const LIMBS: usize = nlimbs(BITS);
                 type U = Uint<BITS, LIMBS>;
                 proptest!(|(value: U)| {
-                    let obj = value.into_py(py);
-                    let native = obj.extract::<U>(py).unwrap();
+                    let obj = value.into_pyobject(py).unwrap();
+                    let native = Uint::<BITS, LIMBS>::extract_bound(&obj).unwrap();
                     assert_eq!(value, native);
                 });
             });
@@ -145,19 +156,19 @@ mod test {
     #[test]
     fn test_errors() {
         pyo3::prepare_freethreaded_python();
-        Python::with_gil(|py| {
-            let obj = (-1_i64).to_object(py);
-            assert!(obj.extract::<U0>(py).is_err());
-            assert!(obj.extract::<U256>(py).is_err());
-
-            let obj = (1000_i64).to_object(py);
-            assert!(obj.extract::<U0>(py).is_err());
-            assert!(obj.extract::<U8>(py).is_err());
-
-            let obj = U512::MAX.to_object(py);
-            assert!(obj.extract::<U0>(py).is_err());
-            assert!(obj.extract::<U64>(py).is_err());
-            assert!(obj.extract::<U256>(py).is_err());
+        Python::with_gil(|py: Python<'_>| {
+            let obj = (-1_i64).into_pyobject(py).unwrap();
+            assert!(U0::extract_bound(&obj).is_err());
+            assert!(U256::extract_bound(&obj).is_err());
+
+            let obj = (1000_i64).into_pyobject(py).unwrap();
+            assert!(U0::extract_bound(&obj).is_err());
+            assert!(U8::extract_bound(&obj).is_err());
+
+            let obj = U512::MAX.into_pyobject(py).unwrap();
+            assert!(U0::extract_bound(&obj).is_err());
+            assert!(U64::extract_bound(&obj).is_err());
+            assert!(U256::extract_bound(&obj).is_err());
         });
     }
 }