classification
Title: runtime error: applying zero offset to null pointer in Objects/listobject.c
Type: compile error Stage: resolved
Components: Interpreter Core Versions: Python 3.11, Python 3.10, Python 3.9
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: Mark.Shannon, lukasz.langa, mark.dickinson, miss-islington, serhiy.storchaka, thatiparthy
Priority: normal Keywords: patch

Created on 2021-07-22 07:16 by thatiparthy, last changed 2021-07-29 12:06 by lukasz.langa. This issue is now closed.

Pull Requests
URL Status Linked Edit
PR 27292 merged serhiy.storchaka, 2021-07-22 20:14
PR 27442 merged miss-islington, 2021-07-29 11:36
PR 27443 merged miss-islington, 2021-07-29 11:36
Messages (6)
msg397978 - (view) Author: Srinivas Reddy Thatiparthy(శ్రీనివాస్ రెడ్డి తాటిపర్తి) (thatiparthy) * Date: 2021-07-22 07:16
After seeing this issue https://bugs.python.org/issue44698, I wanted to run clang on the main branch (c878f5d81772dc6f718d6608c78baa4be9a4f176) with an undefined option enabled.

Is the following a bug or false positive?

Objects/listobject.c:527:24: runtime error: applying zero offset to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/listobject.c:527:24 in


Steps to reproduce.
1. export CC="/usr/bin/clang -fsanitize=undefined"
2. ./configure --with-pydebug --with-openssl=$(brew --prefix openssl)
3. make -j

Meta :
➜ clang --version
Apple clang version 12.0.5 (clang-1205.0.22.9)
Target: x86_64-apple-darwin20.6.0
Thread model: posix
InstalledDir: /Library/Developer/CommandLineTools/usr/bin

➜ uname -a
Darwin Srinivass-MBP.Dlink 20.6.0 Darwin Kernel Version 20.6.0: Wed Jun 23 00:26:31 PDT 2021; root:xnu-7195.141.2~5/RELEASE_X86_64 x86_64
msg397999 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2021-07-22 20:07
AFAIK pointer arithmetic with NULL has undefined behavior. There is similar case in list_slice().
msg398013 - (view) Author: Łukasz Langa (lukasz.langa) * (Python committer) Date: 2021-07-22 22:24
Interestingly I cannot reproduce the clang report on macOS 10.15 with clang 12.0.0. Maybe it's a new capability of clang 12.0.5 in Big Sur.
msg398059 - (view) Author: Łukasz Langa (lukasz.langa) * (Python committer) Date: 2021-07-23 14:43
I'm still unable to reproduce this locally. Objects/listobject.c:527:24 is this line in `list_concat`:

    dest = np->ob_item + Py_SIZE(a);

(permalink: https://github.com/python/cpython/blob/8f42106b5c362495f72c6ca2fa3884538e4023db/Objects/listobject.c#L527)

This can only be problematic if `ob_item` of the new list is NULL *AND* list `a` is non-empty. In practice that's impossible because if `a` is non-empty, it would already populate `np` with its elements using the for-loop right above the line in question.

So this sounds like the compiler complaining about NULL + 0 which seems unnecessary?

By the way, instead of messing with CC, it's preferred to use the --with-undefined-behavior-sanitizer option to ./configure.

We could accept Serhiy's change but I'm afraid that without a reliable way to reproduce, this will regress at some point.
msg398478 - (view) Author: Mark Shannon (Mark.Shannon) * (Python committer) Date: 2021-07-29 11:36
New changeset e5c8ddb1714fb51ab1defa24352c98e0f01205dc by Serhiy Storchaka in branch 'main':
bpo-44707: Fix an undefined behavior of the null pointer arithmetic (GH-27292)
https://github.com/python/cpython/commit/e5c8ddb1714fb51ab1defa24352c98e0f01205dc
msg398481 - (view) Author: Łukasz Langa (lukasz.langa) * (Python committer) Date: 2021-07-29 12:06
New changeset 12fc0d28fcdeca32314d0755d3b30c7d96907440 by Miss Islington (bot) in branch '3.9':
bpo-44707: Fix an undefined behavior of the null pointer arithmetic (GH-27292) (GH-27443)
https://github.com/python/cpython/commit/12fc0d28fcdeca32314d0755d3b30c7d96907440
msg398482 - (view) Author: Łukasz Langa (lukasz.langa) * (Python committer) Date: 2021-07-29 12:06
New changeset 761c641f19838517bcf8df5b91d2eb46880efe68 by Miss Islington (bot) in branch '3.10':
bpo-44707: Fix an undefined behavior of the null pointer arithmetic (GH-27292) (GH-27442)
https://github.com/python/cpython/commit/761c641f19838517bcf8df5b91d2eb46880efe68
History
Date User Action Args
2021-07-29 12:06:08lukasz.langasetmessages: + msg398482
2021-07-29 12:06:08lukasz.langasetmessages: + msg398481
2021-07-29 12:06:05lukasz.langasetstatus: open -> closed
resolution: fixed
stage: patch review -> resolved
2021-07-29 11:36:38miss-islingtonsetpull_requests: + pull_request25972
2021-07-29 11:36:33miss-islingtonsetnosy: + miss-islington
pull_requests: + pull_request25971
2021-07-29 11:36:32Mark.Shannonsetnosy: + Mark.Shannon
messages: + msg398478
2021-07-23 14:43:45lukasz.langasetmessages: + msg398059
2021-07-22 22:24:49lukasz.langasetnosy: + lukasz.langa
messages: + msg398013
2021-07-22 20:14:16serhiy.storchakasetkeywords: + patch
stage: patch review
pull_requests: + pull_request25835
2021-07-22 20:07:31serhiy.storchakasetversions: + Python 3.9, Python 3.10, Python 3.11
nosy: + mark.dickinson, serhiy.storchaka

messages: + msg397999

components: + Interpreter Core
type: compile error
2021-07-22 07:16:09thatiparthycreate