classification
Title: MemoryView_FromObject crashes if PyBuffer_GetBuffer fails
Type: crash Stage: resolved
Components: Interpreter Core Versions: Python 3.1, Python 3.2, Python 2.7
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: pitrou Nosy List: flox, pitrou, pv
Priority: high Keywords: patch

Created on 2009-11-23 22:07 by pv, last changed 2010-02-02 22:52 by pitrou. This issue is now closed.

Files
File name Uploaded Description Edit
issue7385_memoryview_v2.diff flox, 2010-02-02 22:16 Patch, apply to trunk
Messages (8)
msg95660 - (view) Author: Pauli Virtanen (pv) * Date: 2009-11-23 22:07
In Objects/memoryobject.c:PyMemoryView_FromObject there's a
_PyObject_GC_UNTRACK unpaired with corresponding _PyObject_GC_TRACK,
which seems to cause a segmentation fault. This can be triggered by
calling PyMemoryView_FromObject on an object whose bf_getbuffer returns
an error.

PyMemoryView_FromObject(PyObject *base) {
   ...
   if (PyObject_GetBuffer(base, &(mview->view), PyBUF_FULL_RO) < 0) {
       Py_DECREF(mview);
       return NULL;
   } 
   ...
   _PyObject_GC_TRACK(mview);
}
...
static void memory_dealloc(PyMemoryViewObject *self) {
   _PyObject_GC_UNTRACK(self); 
   ....
}
msg95962 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2009-12-04 13:31
Nice catch. I wonder whether there's a simple way of cooking up an unit
test for this (short of creating a new extension type).
msg98578 - (view) Author: Florent Xicluna (flox) * (Python committer) Date: 2010-01-30 22:39
Proposed test and fix.
Please comment, there's probably room for improvement.
msg98583 - (view) Author: Florent Xicluna (flox) * (Python committer) Date: 2010-01-30 23:53
Removed /* XXX */ code
msg98755 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2010-02-02 19:39
When PyMemoryView_FromObject() doesn't return NULL, you should decref the result. Otherwise, it's "perfect".
msg98759 - (view) Author: Florent Xicluna (flox) * (Python committer) Date: 2010-02-02 22:16
Thanks.
msg98761 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2010-02-02 22:36
I've added a missing call to PyBuffer_Release() and committed the patch to trunk (r77916).
msg98767 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2010-02-02 22:52
Merged in r77918 (py3k) and r77920 (3.1).
History
Date User Action Args
2010-02-02 22:52:10pitrousetstatus: open -> closed
resolution: fixed
messages: + msg98767

stage: patch review -> resolved
2010-02-02 22:36:47pitrousetmessages: + msg98761
2010-02-02 22:16:31floxsetfiles: + issue7385_memoryview_v2.diff

messages: + msg98759
2010-02-02 22:09:33floxsetfiles: - issue7385_memoryview.diff
2010-02-02 19:39:47pitrousetmessages: + msg98755
2010-01-30 23:53:02floxsetfiles: + issue7385_memoryview.diff

messages: + msg98583
2010-01-30 23:52:39floxsetfiles: - issue7385_memoryview.diff
2010-01-30 22:39:02floxsetfiles: + issue7385_memoryview.diff
keywords: + patch
messages: + msg98578

stage: needs patch -> patch review
2010-01-13 20:25:32floxsetnosy: + flox
2009-12-04 13:31:50pitrousetpriority: high

assignee: pitrou
versions: + Python 2.7, Python 3.2
nosy: + pitrou

messages: + msg95962
stage: needs patch
2009-12-03 22:51:19pvsettype: crash
2009-11-23 22:07:06pvcreate