8000 bpo-38368: Added fix for ctypes crash when handling arrays in structs… by vsajip · Pull Request #16589 · python/cpython · GitHub
[go: up one dir, main page]

Skip to content

bpo-38368: Added fix for ctypes crash when handling arrays in structs… #16589

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Oct 8, 2019
Prev Previous commit
Next Next commit
Changes in response to review comments.
  • Loading branch information
vsajip committed Oct 5, 2019
commit 2b07ffe235389ca7d771f40f616b075a3471a817
6 changes: 4 additions & 2 deletions Modules/_ctypes/stgdict.c
Original file line number Diff line number Diff line change
Expand Up @@ -729,8 +729,8 @@ PyCStructUnionType_update_stgdict(PyObject *type, PyObject *fields, int isStruct
if (PyCArrayTypeObject_Check(desc)) {
Py_ssize_t length = dict->length;
StgDictObject *edict;
ffi_type * dummy_struct;
ffi_type ** dummy_fields;
ffi_type *dummy_struct;
ffi_type **dummy_fields;
Py_ssize_t dummy_index;

edict = PyType_stgdict(dict->proto);
Expand All @@ -745,11 +745,13 @@ PyCStructUnionType_update_stgdict(PyObject *type, PyObject *fields, int isStruct
/* Do separate allocations for now. */
dummy_struct = PyMem_New(ffi_type, 1);
if (dummy_struct == NULL) {
Py_DECREF(pair);
PyErr_NoMemory();
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there should be a Py_DECREF(pair); here.

return -1;
}
dummy_fields = PyMem_New(ffi_type *, length + 1);
if (dummy_fields == NULL) {
Py_DECREF(pair);
PyErr_NoMemory();
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think dummy_struct should be freed here. Also, pair should be decrefed.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, the problem is that we're doing these allocations in a loop, and unless we keep some sort of linked list or dynamically allocated structure to keep track of all our allocations (both dummy_struct and dummy_fields in earlier iterations of the loop), we will leak this memory in an Out Of Memory (OOM) situation. I'm not aware that we currently do this type of recovery for these internal allocations in an OOM situation, but happy to be proved wrong.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will have a think about an alternative allocation strategy which allows an easier recovery, but it will be potentially a little harder to follow the logic compared to what's there now.

return -1;
}
Expand Down
0