Closed
Description
numpy.vdot may segfault if passed an object that implements __array__ in a non-standard way.
The segfault happens in this line of code:
https://github.com/numpy/numpy/blob/master/numpy/core/src/multiarray/multiarraymodule.c#L2245
since type may be NULL if PyArray_DescrFromType fails.
Reproducing code example:
import numpy as np
class Foo(object):
def __array__(self, a):
return self
np.vdot(Foo(), Foo())Error message:
Backtrace:
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
* frame #0: 0x0000000100cef88e _multiarray_umath.cpython-37m-darwin.so`array_vdot + 126
frame #1: 0x00000001005e0994 python`PyCFunction_Call + 148
frame #2: 0x0000000100c48dc1 _multiarray_umath.cpython-37m-darwin.so`array_implement_array_function + 305
frame #3: 0x00000001005e11b3 python`_PyMethodDef_RawFastCallKeywords + 227
frame #4: 0x00000001005e071c python`_PyCFunction_FastCallKeywords + 44
frame #5: 0x00000001006b6048 python`call_function + 664
frame #6: 0x00000001006b2a18 python`_PyEval_EvalFrameDefault + 27080
frame #7: 0x00000001006b6e45 python`_PyEval_EvalCodeWithName + 2997
frame #8: 0x00000001005e06d6 python`_PyFunction_FastCallKeywords + 230
frame #9: 0x00000001006b60d9 python`call_function + 809
frame #10: 0x00000001006b2987 python`_PyEval_EvalFrameDefault + 26935
frame #11: 0x00000001006b6e45 python`_PyEval_EvalCodeWithName + 2997
frame #12: 0x00000001006abfb0 python`PyEval_EvalCode + 48
frame #13: 0x00000001006ee677 python`PyRun_InteractiveOneObjectEx + 615
frame #14: 0x00000001006ede4e python`PyRun_InteractiveLoopFlags + 190
frame #15: 0x00000001006edd5c python`PyRun_AnyFileExFlags + 60
frame #16: 0x0000000100710c51 python`pymain_main + 7873
frame #17: 0x000000010071127f python`_Py_UnixMain + 111
frame #18: 0x00007fff5f6e63d5 libdyld.dylib`start + 1
Numpy/Python version information:
I've reproduced this both on Mac OS X with:
1.17.0 3.7.2 (default, Jan 16 2019, 11:36:28)
[Clang 10.0.0 (clang-1000.11.45.2)]
and on an internal Linux build.
This issue was originally reported as jax-ml/jax#1162