classification
Title: segfault in ctypes.cast
Type: crash Stage: backport needed
Components: ctypes Versions: Python 2.7
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: Anthony.LaTorre, Oren Milman, amaury.forgeotdarc, belopolsky, eryksun, meador.inge, miss-islington, steve.dower
Priority: normal Keywords: patch

Created on 2014-07-14 21:53 by Anthony.LaTorre, last changed 2019-08-02 22:36 by steve.dower.

Pull Requests
URL Status Linked Edit
PR 3859 merged Oren Milman, 2017-10-02 18:43
PR 6745 merged miss-islington, 2018-05-09 21:40
PR 6746 merged miss-islington, 2018-05-09 21:42
Messages (9)
msg223062 - (view) Author: Anthony LaTorre (Anthony.LaTorre) Date: 2014-07-14 21:53
I get a segfault when trying to cast a string to a structure. 
>>> import ctypes
>>> class Struct(ctypes.Structure):
...     _fields_ = [('a', ctypes.c_uint32)]
... 
>>> s = '0'*100
>>> ctypes.cast(s,Struct)
Segmentation fault

The docs (https://docs.python.org/2/library/ctypes.html#ctypes.cast) say that `obj` "must be an object that can be interpreted as a pointer", so I assume this should return the same exception you get when trying to cast a list:

>>> ctypes.cast(range(10),Struct)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.4/ctypes/__init__.py", line 488, in cast
    return _cast(obj, obj, typ)
ctypes.ArgumentError: argument 1: <class 'TypeError'>: wrong type
msg223069 - (view) Author: Eryk Sun (eryksun) * (Python triager) Date: 2014-07-15 00:15
You need to cast to a pointer type, i.e. POINTER(Struct). Trying to cast to just Struct should raise a TypeError. Instead this revealed a bug in cast_check_pointertype (3.4.1):

http://hg.python.org/cpython/file/c0e311e010fc/Modules/_ctypes/_ctypes.c#l5225

dict->proto is NULL in the Struct type's stgdict, so PyUnicode_Check(dict->proto) segfaults. A simple fix is to add a check for this on line 5235:

    if (dict && dict->proto) {

Then cast will raise the expected TypeError from line 5242 on return from line 5255.
msg223100 - (view) Author: Mark Lawrence (BreamoreBoy) * Date: 2014-07-15 11:07
I'll provide a patch but I don't know which test file to use, can somebody please advise.
msg303468 - (view) Author: Oren Milman (Oren Milman) * Date: 2017-10-01 17:14
IMHO, Lib/ctypes/test/test_cast.py is the relevant test.

Mark, do you still wish to provide a fix for that?
(Otherwise, i would be happy to open a PR.)
msg316334 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2018-05-09 21:39
New changeset d518d8bc8d5dac1a1270612f424d33e0e5afc2b5 by Steve Dower (Oren Milman) in branch 'master':
bpo-21983: Fix a crash in ctypes.cast() when passed a ctypes structured data type (GH-3859)
https://github.com/python/cpython/commit/d518d8bc8d5dac1a1270612f424d33e0e5afc2b5
msg316337 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2018-05-09 21:44
The backport to 2.7 needs some help. I can't do it on my laptop for the next week, but I'll try to get to it eventually. Feel free to get there first.
msg316339 - (view) Author: miss-islington (miss-islington) Date: 2018-05-09 22:28
New changeset 8ac158a6dfb86880e22003afe0ff39ec31b0a094 by Miss Islington (bot) in branch '3.6':
bpo-21983: Fix a crash in ctypes.cast() when passed a ctypes structured data type (GH-3859)
https://github.com/python/cpython/commit/8ac158a6dfb86880e22003afe0ff39ec31b0a094
msg317754 - (view) Author: miss-islington (miss-islington) Date: 2018-05-26 18:39
New changeset e60f6e1864d80d80f8928afadec617d161a64150 by Miss Islington (bot) in branch '3.7':
bpo-21983: Fix a crash in ctypes.cast() when passed a ctypes structured data type (GH-3859)
https://github.com/python/cpython/commit/e60f6e1864d80d80f8928afadec617d161a64150
msg326039 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2018-09-21 20:48
Still needs a backport to 2.7
History
Date User Action Args
2019-08-02 22:36:47steve.dowersetassignee: steve.dower ->
stage: patch review -> backport needed
versions: - Python 3.6, Python 3.7, Python 3.8
2018-09-21 20:48:47steve.dowersetmessages: + msg326039
2018-05-26 18:39:54miss-islingtonsetmessages: + msg317754
2018-05-09 22:28:01miss-islingtonsetnosy: + miss-islington
messages: + msg316339
2018-05-09 21:44:27steve.dowersetmessages: + msg316337
versions: + Python 3.6
2018-05-09 21:42:07miss-islingtonsetpull_requests: + pull_request6434
2018-05-09 21:40:12miss-islingtonsetstage: backport needed -> patch review
pull_requests: + pull_request6433
2018-05-09 21:40:00steve.dowersetassignee: steve.dower
stage: patch review -> backport needed
versions: + Python 3.8, - Python 3.4
2018-05-09 21:39:00steve.dowersetnosy: + steve.dower
messages: + msg316334
2017-10-02 18:44:28Oren Milmansetversions: + Python 2.7, Python 3.4
2017-10-02 18:44:04Oren Milmansetversions: + Python 3.7, - Python 2.7, Python 3.4
2017-10-02 18:43:20Oren Milmansetkeywords: + patch
stage: patch review
pull_requests: + pull_request3839
2017-10-02 00:32:54BreamoreBoysetnosy: - BreamoreBoy
2017-10-01 17:14:06Oren Milmansetnosy: + Oren Milman
messages: + msg303468
2014-07-15 11:07:41BreamoreBoysetnosy: + belopolsky, amaury.forgeotdarc, meador.inge, BreamoreBoy
messages: + msg223100
2014-07-15 00:15:55eryksunsetnosy: + eryksun
messages: + msg223069
2014-07-14 21:54:05Anthony.LaTorresetcomponents: + ctypes
2014-07-14 21:53:26Anthony.LaTorrecreate