address unchecked write

dev_tools/protos.txt

@@ -1,2 +1,2 @@
-grpcio-tools~=1.62.3
-mypy-protobuf~=3.6
+grpcio-tools
+mypy-protobuf

test/test_value_array.py

@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+from typing import Any
 import itertools
 import pickle
 
@@ -256,6 +257,15 @@ def test_pick_roundtrip() -> None:
             assert all(x == pickle.loads(s))
 
 
+def test_pickle_issafe() -> None:
+    x = (tu.ns * tu.GHz * [1, 2, 3]).display_units
+    s: dict[str, Any] = x.__getstate__()  # type: ignore[assignment]
+    s['unit_count'] = 0
+    with pytest.raises(ValueError, match="invalid pickle"):
+        y = ValueArray("")
+        y.display_units.__setstate__(s)  # type: ignore[attr-defined]
+
+
 class _InvalidUnit:
     pass
 

tunits/core/cython/unit_array.pyx

@@ -244,6 +244,8 @@ cdef class UnitArray:
         }
 
     def __setstate__(self, pickle_info: dict[str, Any]):
+        if len(pickle_info['units']) != pickle_info['unit_count']:
+            raise ValueError("invalid pickle dictionary")
         self.unit_count = pickle_info['unit_count']
         self.units = <UnitTerm *>PyMem_Malloc(self.unit_count*sizeof(UnitTerm))
         for i, (name, numer, denom) in enumerate(pickle_info['units']):