[issue16686] audioop overflow issues
Roundup Robot added the comment: New changeset 6add6ac6a802 by Serhiy Storchaka in branch '2.7': Issue #16686: Fixed a lot of bugs in audioop module. http://hg.python.org/cpython/rev/6add6ac6a802 New changeset 104b17f8316b by Serhiy Storchaka in branch '3.2': Issue #16686: Fixed a lot of bugs in audioop module. http://hg.python.org/cpython/rev/104b17f8316b New changeset 63b164708e60 by Serhiy Storchaka in branch '3.3': Issue #16686: Fixed a lot of bugs in audioop module. http://hg.python.org/cpython/rev/63b164708e60 New changeset 48747ef5f65b by Serhiy Storchaka in branch 'default': Issue #16686: Fixed a lot of bugs in audioop module. http://hg.python.org/cpython/rev/48747ef5f65b -- nosy: +python-dev ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Serhiy Storchaka added the comment: I fixed yet one bug in avgpp() and remove my XXX comment. *All* audioop functions are unsafe regarding unaligned access. I'll open a new issue for this. -- resolution: - fixed stage: patch review - committed/rejected status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Serhiy Storchaka added the comment: *All* audioop functions are unsafe regarding unaligned access. Actually this is not true because currently audioop functions work only with bytes (and str, see issue16685) and not with arbitrary memoryview. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Serhiy Storchaka added the comment: Thank you Terry. Is whatever the case in 2.6 only (if so, drop obsolete) or since 2.6. If the latter, I would rewrite as this is the case since Python 2.6.. The addition is not clear to me. Are you implying that something should be made true for memory view (in a future patch)? In 2.6 the sentence possible was true and the code was correct. But it is wrong for currently supported versions when we pass memoryview as an argument. This is a bug (possible even a crash) and should be fixed. But on x86 or when we don't use unaligned memoryview (most peoples don't do this) it is never occurred. Due to this I left this bug unfixed yet. There are other minor bugs which I left for different issues. This patch fixes most critical bugs and creates a solid basis for testing. I see unstable AIX buildbots failed on test_aifc. Perhaps this patch will fix it or expose an issue in audioop module (current audioop testing too poor). -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Serhiy Storchaka added the comment: Since there is no one who want to review the patch for this dirty buggy module, I will test and review it myself yet once and then commit. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Terry J. Reedy added the comment: I do not have the knowledge needed to review the code, but I took a brief look. The three doc patches need a verb to be proper English. Samples truncated in case of overflow. should be Samples are truncated in case of overflow. in both places. I think Samples wrapped around in case of overflow. could be rewritten as Samples wrap around in case of overflow., though adding 'are' works too. In the C code comment: /* Passing a short** for an 's' argument is correct only if the string contents is aligned for interpretation as short[]. Due to the definition of PyBytesObject, - this is currently (Python 2.6) the case. */ + this is currently (Python 2.6) the case. + XXX: It's not true for memoryview. */ Is whatever the case in 2.6 only (if so, drop obsolete) or since 2.6. If the latter, I would rewrite as this is the case since Python 2.6.. The addition is not clear to me. Are you implying that something should be made true for memory view (in a future patch)? -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Serhiy Storchaka added the comment: Can anyone look at the patch? I want fix this issue before 2.7.4 RC released. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Changes by Serhiy Storchaka storch...@gmail.com: -- assignee: - serhiy.storchaka ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Serhiy Storchaka added the comment: I found that the documentation contains a receipt which depends on the fact that bias() wraps around samples. Here is an updated patch. Also some docs changes included. -- Added file: http://bugs.python.org/file28395/audioop_2.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Changes by Serhiy Storchaka storch...@gmail.com: Added file: http://bugs.python.org/file28396/audioop_2.py ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Changes by Serhiy Storchaka storch...@gmail.com: Added file: http://bugs.python.org/file28397/audioop_2.py ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Changes by Serhiy Storchaka storch...@gmail.com: Removed file: http://bugs.python.org/file28364/audioop.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Changes by Serhiy Storchaka storch...@gmail.com: Removed file: http://bugs.python.org/file28365/audioop_tests.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Changes by Serhiy Storchaka storch...@gmail.com: Removed file: http://bugs.python.org/file28366/audioop.py ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Changes by Serhiy Storchaka storch...@gmail.com: -- stage: needs patch - patch review ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Changes by Arfrever Frehtes Taifersar Arahesis arfrever@gmail.com: -- nosy: +Arfrever ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Changes by Terry J. Reedy tjre...@udel.edu: -- nosy: +terry.reedy ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Serhiy Storchaka added the comment: 6. reverse() and ratecv() lose 16 lowest bits for 4-bytes data. 7. rms() can returns negative value (-0x8000 instead 0x8000). 8. maxpp() and avgpp() overflow and return absolutely wrong result for large peaks. 9. ratecv() crashes Python on empty input. -- type: behavior - crash ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Serhiy Storchaka added the comment: 5. max(b'\x00\x00\x00\x80', 4) returns 0 (on little-endian). -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
New submission from Serhiy Storchaka: The audioop module has some issues with an overflow. 1. It uses post-checks for an integer overflow. This means using an undefined behavior. 2. When the result truncated in case of overflow, -maxval used as minimal value. But real minimum value is less (-maxval - 1). This means not using full possible range and causes an odd result of some operations (for example add(b'\x80', '\x00', 1) returns b'\x81'). 3. Some operations (for example bias()) does not truncating and just overflow. 4. lin2lin() conversion from 4 to 4 (should do nothing) loses 16 lowest bits. -- components: Extension Modules messages: 177482 nosy: mark.dickinson, serhiy.storchaka priority: normal severity: normal stage: needs patch status: open title: audioop overflow issues type: behavior versions: Python 2.7, Python 3.2, Python 3.3, Python 3.4 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue16686] audioop overflow issues
Changes by Jesús Cea Avión j...@jcea.es: -- nosy: +jcea ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue16686 ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
