This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Result of multiprocessing.heap.BufferWrapper.create_memoryview can point to freed memory
Type: Stage:
Components: ctypes, Library (Lib) Versions: Python 3.10, Python 3.9
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: Eric Wieser
Priority: normal Keywords:

Created on 2020-08-31 12:56 by Eric Wieser, last changed 2022-04-11 14:59 by admin.

Messages (2)
msg376149 - (view) Author: Eric Wieser (Eric Wieser) Date: 2020-08-31 12:56
The full definition of `multiprocessing.heap.BufferWrapper` is:

    class BufferWrapper(object):

        _heap = Heap()

        def __init__(self, size):
            if size < 0:
                raise ValueError("Size {0:n} out of range".format(size))
            if sys.maxsize <= size:
                raise OverflowError("Size {0:n} too large".format(size))
            block = BufferWrapper._heap.malloc(size)
            self._state = (block, size)
            util.Finalize(self, BufferWrapper._heap.free, args=(block,))

        def create_memoryview(self):
            (arena, start, stop), size = self._state
            return memoryview(arena.buffer)[start:start+size]


But this means that a `memoryview` can be constructed that point to free'd "memory",


    >>> b = BufferWrapper(10)
    >>> m = b.create_memoryview()
    >>> del b  # free is called
    >>> b[0]  # making this invalid

It would be better if `m` would keep a reference to `b` so that it remains alive.
`RawArray` works around this by placing a reference to `b` in `ctypes_obj._wrapper`, but this results in `b` being lost again if `m2 = memoryview(ctypes_obj); del ctypes_obj` is used.
msg376150 - (view) Author: Eric Wieser (Eric Wieser) Date: 2020-08-31 12:57
Whoops, typo. `>>> b[0]` should read `m[0]`.
History
Date User Action Args
2022-04-11 14:59:35adminsetgithub: 85839
2020-08-31 12:57:18Eric Wiesersetmessages: + msg376150
2020-08-31 12:56:22Eric Wiesercreate