Repository navigation
ctypes: SIGSEGV when subscripting a pointer type without _type_ #161471
Description
Crash report
A subclass of ctypes._Pointer without _type_ cannot be instantiated
normally (Pointer_new() raises TypeError: Cannot create instance: has no _type_), but from_buffer() / from_address() bypass that check and create
the instance through PyCData_AtAddress(). Slicing such an instance then
dereferences NULL and the process dies with SIGSEGV (exit 139):
import ctypes
class P(ctypes._Pointer):
pass
obj = P.from_buffer(bytearray(8))
obj[0:1] # SIGSEGVASan trace:
ddressSanitizer:DEADLYSIGNAL
=================================================================
==21433==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x562ca4ac5530 bp 0x7ffebd7fba60 sp 0x7ffebd7fb9a0 T0)
==21433==The signal is caused by a READ memory access.
==21433==Hint: address points to the zero page.
#0 0x562ca4ac5530 in _Py_IS_TYPE_impl /work/cpython/./Include/object.h:249:24
#1 0x562ca4ac5530 in object_recursive_isinstance /work/cpython/Objects/abstract.c:2674:9
#2 0x7fc1abf61565 in _stginfo_from_type /work/cpython/./Modules/_ctypes/ctypes.h:577:10
#3 0x7fc1abf83e0b in PyStgInfo_FromType /work/cpython/./Modules/_ctypes/ctypes.h:594:12
#4 0x7fc1abf83e0b in Pointer_subscript /work/cpython/./Modules/_ctypes/_ctypes.c:5962:13
#5 0x562ca4aac735 in PyObject_GetItem /work/cpython/Objects/abstract.c:164:26
#6 0x562ca514bb55 in _PyEval_EvalFrameDefault /work/cpython/Python/generated_cases.c.h:67:35
#7 0x562ca5119c4c in _PyEval_Vector /work/cpython/Python/ceval.c:2194:12
#8 0x562ca5119c4c in PyEval_EvalCode /work/cpython/Python/ceval.c:638:21
#9 0x562ca53fba96 in run_mod /work/cpython/Python/pythonrun.c:1509:19
#10 0x562ca53f2056 in _PyRun_File /work/cpython/Python/pythonrun.c:1332:15
#11 0x562ca53f2056 in _PyRun_SimpleFile /work/cpython/Python/pythonrun.c:544:15
#12 0x562ca53f1506 in _PyRun_AnyFile /work/cpython/Python/pythonrun.c:92:18
#13 0x562ca54d1cc7 in pymain_run_file_obj /work/cpython/Modules/main.c:479:24
#14 0x562ca54d1cc7 in pymain_run_file /work/cpython/Modules/main.c:495:20
#15 0x562ca54cf3aa in pymain_run_python /work/cpython/Modules/main.c:813:21
#16 0x562ca54cf3aa in Py_RunMain /work/cpython/Modules/main.c:900:5
#17 0x562ca54d0864 in pymain_main /work/cpython/Modules/main.c:927:12
#18 0x562ca54d0c68 in Py_BytesMain /work/cpython/Modules/main.c:951:12
#19 0x7fc1ac982efc in __libc_start_main (/lib64/libc.so.6+0x27efc) (BuildId: f11c7b85e0841f76566e6839cc55cd7d4d9c9601)
#20 0x562ca4784189 in _start /usr/src/RPM/BUILD/glibc-2.32-alt5.p10.7/csu/../sysdeps/x86_64/start.S:120
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /work/cpython/./Include/object.h:249:24 in _Py_IS_TYPE_impl
Found by Linux Verification Center (linuxtesting.org) with SVACE
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Output from running 'python -VV' on the command line:
No response
Activity