BUG: Invalid read of size 4 in PyArray_FromFile

rainwoodman · charris · commit f14ad751198b · 2016-06-17T19:11:30.000-06:00
When the input dtype has a subarray, the dtype is DECREFed by PyArray_NewFromDescr, before dtype->elsize is accessed. If no one else holds a reference to the dtype object, then the dtype object will be destroyed, and dtype->elsize shall not be accessed. This raises an error in Valgrind, and occasionally crashes innocently looking code. e.g. ```numpy.fromfile('filename', dtype=('f8', 3'))``` This affects versions as early as 1.9.2 (where I found this bug) and seems to be still relevant today. Closes #7756.
diff --git a/numpy/core/src/multiarray/ctors.c b/numpy/core/src/multiarray/ctors.c
@@ -3260,17 +3260,20 @@ array_fromfile_binary(FILE *fp, PyArray_Descr *dtype, npy_intp num, size_t *nrea
         }
         num = numbytes / dtype->elsize;
     }
+    Py_INCREF(dtype);
     r = (PyArrayObject *)PyArray_NewFromDescr(&PyArray_Type,
                                               dtype,
                                               1, &num,
                                               NULL, NULL,
                                               0, NULL);
     if (r == NULL) {
-        return NULL;
+        goto fail;
     }
     NPY_BEGIN_ALLOW_THREADS;
     *nread = fread(PyArray_DATA(r), dtype->elsize, num, fp);
     NPY_END_ALLOW_THREADS;
+fail:
+    Py_DECREF(dtype);
     return r;
 }
 
@@ -3293,13 +3296,16 @@ array_from_text(PyArray_Descr *dtype, npy_intp num, char *sep, size_t *nread,
     npy_intp bytes, totalbytes;
 
     size = (num >= 0) ? num : FROM_BUFFER_SIZE;
+
+    Py_INCREF(dtype);
     r = (PyArrayObject *)
         PyArray_NewFromDescr(&PyArray_Type,
                              dtype,
                              1, &size,
                              NULL, NULL,
                              0, NULL);
     if (r == NULL) {
+        Py_DECREF(dtype);
         return NULL;
     }
     clean_sep = swab_separator(sep);
@@ -3348,6 +3354,7 @@ array_from_text(PyArray_Descr *dtype, npy_intp num, char *sep, size_t *nread,
     free(clean_sep);
 
 fail:
+    Py_DECREF(dtype);
     if (err == 1) {
         PyErr_NoMemory();
     }
