Skip to content

gh-111178: fix UBSan failures in Modules/arraymodule.c #129772

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Feb 8, 2025
Merged

gh-111178: fix UBSan failures in Modules/arraymodule.c #129772

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2954645
fix UBSan failures for `arrayobject`
picnixz Feb 6, 2025
e6bf854
fix UBSan failures for `arrayiterobject`
picnixz Feb 6, 2025
985c11a
suppress unused return values
picnixz Feb 6, 2025
ddd7d84
Merge remote-tracking branch 'upstream/main' into fix/ubsan/array-111178
picnixz Feb 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
99 changes: 59 additions & 40 deletions Modules/arraymodule.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,9 @@ get_array_state(PyObject *module)
#define get_array_state_by_class(cls) \
(get_array_state(PyType_GetModule(cls)))

#define arrayobject_CAST(op) ((arrayobject *)(op))
#define arrayiterobject_CAST(op) ((arrayiterobject *)(op))

enum machine_format_code {
UNKNOWN_FORMAT = -1,
/* UNKNOWN_FORMAT is used to indicate that the machine format for an
Expand Down Expand Up @@ -712,22 +715,25 @@ ins1(arrayobject *self, Py_ssize_t where, PyObject *v)
/* Methods */

static int
array_tp_traverse(arrayobject *op, visitproc visit, void *arg)
array_tp_traverse(PyObject *op, visitproc visit, void *arg)
{
Py_VISIT(Py_TYPE(op));
return 0;
}

static void
array_dealloc(arrayobject *op)
array_dealloc(PyObject *op)
{
PyTypeObject *tp = Py_TYPE(op);
PyObject_GC_UnTrack(op);

if (op->weakreflist != NULL)
PyObject_ClearWeakRefs((PyObject *) op);
if (op->ob_item != NULL)
PyMem_Free(op->ob_item);
arrayobject *self = arrayobject_CAST(op);
if (self->weakreflist != NULL) {
PyObject_ClearWeakRefs(op);
}
if (self->ob_item != NULL) {
PyMem_Free(self->ob_item);
}
tp->tp_free(op);
Py_DECREF(tp);
}
Expand Down Expand Up @@ -843,19 +849,19 @@ array_richcompare(PyObject *v, PyObject *w, int op)
}

static Py_ssize_t
array_length(arrayobject *a)
array_length(PyObject *op)
{
return Py_SIZE(a);
return Py_SIZE(op);
}

static PyObject *
array_item(arrayobject *a, Py_ssize_t i)
array_item(PyObject *op, Py_ssize_t i)
{
if (i < 0 || i >= Py_SIZE(a)) {
if (i < 0 || i >= Py_SIZE(op)) {
PyErr_SetString(PyExc_IndexError, "array index out of range");
return NULL;
}
return getarrayitem((PyObject *)a, i);
return getarrayitem(op, i);
}

static PyObject *
Expand Down Expand Up @@ -930,8 +936,9 @@ array_array___deepcopy__(arrayobject *self, PyObject *unused)
}

static PyObject *
array_concat(arrayobject *a, PyObject *bb)
array_concat(PyObject *op, PyObject *bb)
{
arrayobject *a = arrayobject_CAST(op);
array_state *state = find_array_state_by_type(Py_TYPE(a));
Py_ssize_t size;
arrayobject *np;
Expand Down Expand Up @@ -966,8 +973,9 @@ array_concat(arrayobject *a, PyObject *bb)
}

static PyObject *
array_repeat(arrayobject *a, Py_ssize_t n)
array_repeat(PyObject *op, Py_ssize_t n)
{
arrayobject *a = arrayobject_CAST(op);
array_state *state = find_array_state_by_type(Py_TYPE(a));

if (n < 0)
Expand Down Expand Up @@ -1026,8 +1034,9 @@ array_del_slice(arrayobject *a, Py_ssize_t ilow, Py_ssize_t ihigh)
}

static int
array_ass_item(arrayobject *a, Py_ssize_t i, PyObject *v)
array_ass_item(PyObject *op, Py_ssize_t i, PyObject *v)
{
arrayobject *a = arrayobject_CAST(op);
if (i < 0 || i >= Py_SIZE(a)) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
Expand All @@ -1045,7 +1054,7 @@ setarrayitem(PyObject *a, Py_ssize_t i, PyObject *v)
array_state *state = find_array_state_by_type(Py_TYPE(a));
assert(array_Check(a, state));
#endif
return array_ass_item((arrayobject *)a, i, v);
return array_ass_item(a, i, v);
}

static int
Expand Down Expand Up @@ -1105,8 +1114,9 @@ array_do_extend(array_state *state, arrayobject *self, PyObject *bb)
}

static PyObject *
array_inplace_concat(arrayobject *self, PyObject *bb)
array_inplace_concat(PyObject *op, PyObject *bb)
{
arrayobject *self = arrayobject_CAST(op);
array_state *state = find_array_state_by_type(Py_TYPE(self));

if (!array_Check(bb, state)) {
Expand All @@ -1121,8 +1131,9 @@ array_inplace_concat(arrayobject *self, PyObject *bb)
}

static PyObject *
array_inplace_repeat(arrayobject *self, Py_ssize_t n)
array_inplace_repeat(PyObject *op, Py_ssize_t n)
{
arrayobject *self = arrayobject_CAST(op);
const Py_ssize_t array_size = Py_SIZE(self);

if (array_size > 0 && n != 1 ) {
Expand Down Expand Up @@ -1236,13 +1247,13 @@ array_array_index_impl(arrayobject *self, PyObject *v, Py_ssize_t start,
}

static int
array_contains(arrayobject *self, PyObject *v)
array_contains(PyObject *self, PyObject *v)
{
Py_ssize_t i;
int cmp;

for (i = 0, cmp = 0 ; cmp == 0 && i < Py_SIZE(self); i++) {
PyObject *selfi = getarrayitem((PyObject *)self, i);
PyObject *selfi = getarrayitem(self, i);
if (selfi == NULL)
return -1;
cmp = PyObject_RichCompareBool(selfi, v, Py_EQ);
Expand Down Expand Up @@ -2349,22 +2360,24 @@ array_array___reduce_ex___impl(arrayobject *self, PyTypeObject *cls,
}

static PyObject *
array_get_typecode(arrayobject *a, void *closure)
array_get_typecode(PyObject *op, void *Py_UNUSED(closure))
{
arrayobject *a = arrayobject_CAST(op);
char typecode = a->ob_descr->typecode;
return PyUnicode_FromOrdinal(typecode);
}

static PyObject *
array_get_itemsize(arrayobject *a, void *closure)
array_get_itemsize(PyObject *op, void *Py_UNUSED(closure))
{
arrayobject *a = arrayobject_CAST(op);
return PyLong_FromLong((long)a->ob_descr->itemsize);
}

static PyGetSetDef array_getsets [] = {
{"typecode", (getter) array_get_typecode, NULL,
{"typecode", array_get_typecode, NULL,
"the typecode character used to create the array"},
{"itemsize", (getter) array_get_itemsize, NULL,
{"itemsize", array_get_itemsize, NULL,
"the size, in bytes, of one array item"},
{NULL}
};
Expand Down Expand Up @@ -2398,11 +2411,12 @@ static PyMethodDef array_methods[] = {
};

static PyObject *
array_repr(arrayobject *a)
array_repr(PyObject *op)
{
char typecode;
PyObject *s, *v = NULL;
Py_ssize_t len;
arrayobject *a = arrayobject_CAST(op);

len = Py_SIZE(a);
typecode = a->ob_descr->typecode;
Expand All @@ -2425,8 +2439,9 @@ array_repr(arrayobject *a)
}

static PyObject*
array_subscr(arrayobject* self, PyObject* item)
array_subscr(PyObject *op, PyObject *item)
{
arrayobject *self = arrayobject_CAST(op);
array_state *state = find_array_state_by_type(Py_TYPE(self));

if (PyIndex_Check(item)) {
Expand All @@ -2436,7 +2451,7 @@ array_subscr(arrayobject* self, PyObject* item)
}
if (i < 0)
i += Py_SIZE(self);
return array_item(self, i);
return array_item(op, i);
}
else if (PySlice_Check(item)) {
Py_ssize_t start, stop, step, slicelength, i;
Expand Down Expand Up @@ -2488,9 +2503,10 @@ array_subscr(arrayobject* self, PyObject* item)
}

static int
array_ass_subscr(arrayobject* self, PyObject* item, PyObject* value)
array_ass_subscr(PyObject *op, PyObject *item, PyObject *value)
{
Py_ssize_t start, stop, step, slicelength, needed;
arrayobject *self = arrayobject_CAST(op);
array_state* state = find_array_state_by_type(Py_TYPE(self));
arrayobject* other;
int itemsize;
Expand Down Expand Up @@ -2542,7 +2558,7 @@ array_ass_subscr(arrayobject* self, PyObject* item, PyObject* value)
value = array_slice(other, 0, needed);
if (value == NULL)
return -1;
ret = array_ass_subscr(self, item, value);
ret = array_ass_subscr(op, item, value);
Py_DECREF(value);
return ret;
}
Expand Down Expand Up @@ -2649,14 +2665,15 @@ static const void *emptybuf = "";


static int
array_buffer_getbuf(arrayobject *self, Py_buffer *view, int flags)
array_buffer_getbuf(PyObject *op, Py_buffer *view, int flags)
{
if (view == NULL) {
PyErr_SetString(PyExc_BufferError,
"array_buffer_getbuf: view==NULL argument is obsolete");
return -1;
}

arrayobject *self = arrayobject_CAST(op);
view->buf = (void *)self->ob_item;
view->obj = Py_NewRef(self);
if (view->buf == NULL)
Expand Down Expand Up @@ -2689,8 +2706,9 @@ array_buffer_getbuf(arrayobject *self, Py_buffer *view, int flags)
}

static void
array_buffer_relbuf(arrayobject *self, Py_buffer *view)
array_buffer_relbuf(PyObject *op, Py_buffer *Py_UNUSED(view))
{
arrayobject *self = arrayobject_CAST(op);
self->ob_exports--;
}

Expand Down Expand Up @@ -2925,7 +2943,7 @@ typecode -- the typecode character used to create the array\n\
itemsize -- the length in bytes of one array item\n\
");

static PyObject *array_iter(arrayobject *ao);
static PyObject *array_iter(PyObject *op);

static struct PyMemberDef array_members[] = {
{"__weaklistoffset__", Py_T_PYSSIZET, offsetof(arrayobject, weakreflist), Py_READONLY},
Expand Down Expand Up @@ -2985,8 +3003,9 @@ class array.arrayiterator "arrayiterobject *" "find_array_state_by_type(type)->A
/*[clinic end generated code: output=da39a3ee5e6b4b0d input=fb46d5ef98dd95ff]*/

static PyObject *
array_iter(arrayobject *ao)
array_iter(PyObject *op)
{
arrayobject *ao = arrayobject_CAST(op);
array_state *state = find_array_state_by_type(Py_TYPE(ao));
arrayiterobject *it;

Expand All @@ -3007,16 +3026,15 @@ array_iter(arrayobject *ao)
}

static PyObject *
arrayiter_next(arrayiterobject *it)
arrayiter_next(PyObject *op)
{
arrayobject *ao;

arrayiterobject *it = arrayiterobject_CAST(op);
assert(it != NULL);
#ifndef NDEBUG
array_state *state = find_array_state_by_type(Py_TYPE(it));
assert(PyObject_TypeCheck(it, state->ArrayIterType));
#endif
ao = it->ao;
arrayobject *ao = it->ao;
if (ao == NULL) {
return NULL;
}
Expand All @@ -3032,19 +3050,20 @@ arrayiter_next(arrayiterobject *it)
}

static void
arrayiter_dealloc(arrayiterobject *it)
arrayiter_dealloc(PyObject *op)
{
arrayiterobject *it = arrayiterobject_CAST(op);
PyTypeObject *tp = Py_TYPE(it);

PyObject_GC_UnTrack(it);
Py_XDECREF(it->ao);
PyObject_GC_Del(it);
Py_DECREF(tp);
}

static int
arrayiter_traverse(arrayiterobject *it, visitproc visit, void *arg)
arrayiter_traverse(PyObject *op, visitproc visit, void *arg)
{
arrayiterobject *it = arrayiterobject_CAST(op);
Py_VISIT(Py_TYPE(it));
Py_VISIT(it->ao);
return 0;
Expand Down Expand Up @@ -3156,7 +3175,7 @@ array_clear(PyObject *module)
static void
array_free(void *module)
{
array_clear((PyObject *)module);
(void)array_clear((PyObject *)module);
}

/* No functions in array module. */
Expand Down
Loading