Repository navigation
_imp.get_frozen_object possible incorrect use of PyBUF_READ #114685
Description
Activity
Other question, why it was not caught in tests? Does PyObject_GetBuffer() ignore unknown flags or this code was never executed?
PyObject_GetBuffer() expects a numeric flag, but it uses bitflag model with example logic:
if (!REQ_FORMAT(flags)) { /* NULL indicates that the buffer's data type has been cast to 'B'. view->itemsize is the _previous_ itemsize. If shape is present, the equality product(shape) * itemsize = len still holds at this point. The equality calcsize(format) = itemsize does _not_ hold from here on! */ view->format = NULL; } if (REQ_C_CONTIGUOUS(flags) && !MV_C_CONTIGUOUS(baseflags)) { PyErr_SetString(PyExc_BufferError, "memoryview: underlying buffer is not C-contiguous"); return -1; } if (REQ_F_CONTIGUOUS(flags) && !MV_F_CONTIGUOUS(baseflags)) { PyErr_SetString(PyExc_BufferError, "memoryview: underlying buffer is not Fortran contiguous"); return -1; } if (REQ_ANY_CONTIGUOUS(flags) && !MV_ANY_CONTIGUOUS(baseflags)) { PyErr_SetString(PyExc_BufferError, "memoryview: underlying buffer is not contiguous"); return -1; }
PyBYF_READ is equal to 256, so it just contains all the features. PyBUF_SIMPLE is just 0, so no extras.
- added 4 commits that reference this issue on Jan 29, 2024
Unfortunately the value of PyBUF_READ intersects with PyBUF_INDIRECT, PyBUF_FULL and PyBUF_FULL_RO, so we cannot just ban this bit. But fortunately other values has other bits set, so this error is still distinguishable.
What about PyBuffer_FillInfo(Py_buffer *view, PyObject *obj, void *buf, Py_ssize_t len, int readonly, int flags)? Do we need to check flags there as well?
Reacted by Serhiy StorchakaMaybe. We do not have examples of the misuse in this case, and it is much less used, but a similar error is possible here too.
I will send an example PR, so we can decide 👍
Reacted by Serhiy Storchaka
Bug report
It is documented that PyBUF_READ should be used with memoryview objects. But, it is used in PyObject_GetBuffer:
cpython/Python/import.c
Line 3547 in 5ecfd75
Other similar places that access .buf and .len just use PyBUF_SIMPLE, which I think we should use here as well.
I will send a PR.
Originally found by @serhiy-storchaka in #114669 (comment)
Linked PRs