[issue13096] ctypes: segfault with large POINTER type names

[STINNER Victor]

STINNER Victor  added the comment:


New changeset 710dcfd2f4bee034894a39026388f9c21ea976f1 by Victor Stinner 
(stratakis) in branch '2.7':
[2.7] bpo-13096: Fix memory leak in ctypes POINTER handling of large values 
(GH-12100)
https://github.com/python/cpython/commit/710dcfd2f4bee034894a39026388f9c21ea976f1


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Charalampos Stratakis]

Change by Charalampos Stratakis :


--
nosy: +vstinner

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Charalampos Stratakis]

Charalampos Stratakis  added the comment:

It seems the python2 backport was incomplete as a PyMem_Free is missing, making 
buf leak.

--
nosy: +cstratak

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Charalampos Stratakis]

Change by Charalampos Stratakis :


--
pull_requests: +12107

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[R. David Murray]

R. David Murray added the comment:

Committed.

--
nosy: +r.david.murray
resolution:  -> fixed
stage: commit review -> resolved
status: open -> closed
versions: +Python 3.4

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Roundup Robot]

Roundup Robot added the comment:

New changeset e940bb13d010 by R David Murray in branch '3.4':
#13096: Fix segfault in CTypes POINTER handling of large values.
https://hg.python.org/cpython/rev/e940bb13d010

New changeset 02c9c3204a04 by R David Murray in branch 'default':
Merge: #13096: Fix segfault in CTypes POINTER handling of large values.
https://hg.python.org/cpython/rev/02c9c3204a04

New changeset ff59b0f9e142 by R David Murray in branch '2.7':
#13096: Fix segfault in CTypes POINTER handling of large values.
https://hg.python.org/cpython/rev/ff59b0f9e142

--
nosy: +python-dev

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Meador Inge]

Meador Inge added the comment:

Thanks for the review and reminder about this issue, jesstess.  I will apply 
the patch later today.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Jessica McKellar]

Jessica McKellar added the comment:

Thanks for the report and patch, meador.inge.

I'd prefer not to add more globals that are only used in one place, but doing 
so is consistent with the existing style of test_pointers.py, and there's 
plenty in this file that could be cleaned up in another ticket.

* The patch passes `make patchcheck`.
* The full test suite passes with this patch.
* The reproducers in this issue segfault for me without this patch and do not 
segfault with this patch.

lgtm!

=> commit review

--
keywords: +needs review
nosy: +jesstess
stage: patch review -> commit review
versions: +Python 3.5 -Python 3.2, Python 3.3

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Meador Inge]

Meador Inge  added the comment:

Here is a small patch against tip.  OK?

--
keywords: +patch
stage: needs patch -> patch review
Added file: http://bugs.python.org/file23800/issue13096.patch

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Meador Inge]

Changes by Meador Inge :


--
assignee:  -> meador.inge

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Meador Inge]

Meador Inge  added the comment:

Yup, it is the 'alloca' call.  This issue and issue13097 are both 
'alloca' related as mentioned in issue12881.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Brian Brazil]

Brian Brazil  added the comment:

The problem is around line 1734 of callproc.c in tip:

} else if (PyType_Check(cls)) {
typ = (PyTypeObject *)cls;
buf = alloca(strlen(typ->tp_name) + 3 + 1);
sprintf(buf, "LP_%s", typ->tp_name);   <-- segfault is here

Replacing the alloca with a malloc fixes it, so I presume it's hitting the 
stack size limit as 2^25 is 32MB (my stack limit is 8MB).

--
nosy: +bbrazil

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Meador Inge]

Meador Inge  added the comment:

There is similar crasher to this one that can be reproduced like:

[meadori@motherbrain cpython]$ ./python 
Python 3.3.0a0 (default:61de28fa5537+d05350c14e77+, Oct  3 2011, 21:47:04) 
[GCC 4.6.0 20110603 (Red Hat 4.6.0-10)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from ctypes import *
>>> p = POINTER('x' * 2 ** 25)
Segmentation fault (core dumped)

It should be fixed as well.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue13096] ctypes: segfault with large POINTER type names

[Meador Inge]

New submission from Meador Inge :

Reproducible in 2.7 and tip:

[meadori@motherbrain cpython]$ ./python 
Python 3.3.0a0 (default:61de28fa5537+d05350c14e77+, Oct  3 2011, 21:47:04) 
[GCC 4.6.0 20110603 (Red Hat 4.6.0-10)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from ctypes import *
>>> T = type('x' * 2 ** 25, (Structure,), {})
>>> p = POINTER(T)
Segmentation fault (core dumped)

--
components: Extension Modules, ctypes
messages: 144850
nosy: amaury.forgeotdarc, belopolsky, meador.inge
priority: normal
severity: normal
stage: needs patch
status: open
title: ctypes: segfault with large POINTER type names
type: crash
versions: Python 2.7, Python 3.2, Python 3.3

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com