Repository navigation
[3.15] gh-160708: Use the type size for resized ctypes simple objects (GH-160720) - #161806
Merged
Merged
Conversation
…bjects (pythonGH-160720) After ctypes.resize(), a simple object's buffer is larger than its type. bool() and passing the object to a foreign function still used the buffer size, so bool() read past a 16-byte string literal and the call copied the whole buffer into the fixed-size PyCArgObject value, corrupting the heap. Use the type's size instead, like the value getter does since pythongh-159739. bool() now checks the value's bytes directly, which also covers simple types larger than 16 bytes such as c_longdouble_complex on x86-64. (cherry picked from commit 44579b0) Co-authored-by: Saugat Pandey <39925335+iamsaugatpandey@users.noreply.github.com> Co-authored-by: Peter Bierma <zintensitydev@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
After ctypes.resize(), a simple object's buffer is larger than its
type. bool() and passing the object to a foreign function still used
the buffer size, so bool() read past a 16-byte string literal and the
call copied the whole buffer into the fixed-size PyCArgObject value,
corrupting the heap.
Use the type's size instead, like the value getter does since
gh-159739. bool() now checks the value's bytes directly, which also
covers simple types larger than 16 bytes such as c_longdouble_complex
on x86-64.
(cherry picked from commit 44579b0)
Co-authored-by: Saugat Pandey 39925335+iamsaugatpandey@users.noreply.github.com
Co-authored-by: Peter Bierma zintensitydev@gmail.com