gh-152166: Fix array.array.fromlist() exposing uninitialized memory when an element's __index__ resizes the array#152167
Open
iamsharduld wants to merge 1 commit into
Conversation
…mory on reentrant resize array.array.fromlist() preallocated n slots with array_resize() and then filled them at an index recomputed from the live Py_SIZE(self) each iteration, guarding only against the source list changing size. When an element's __index__ resized self as a side effect of the setitem call, the write index slid forward, the reserved slots were left unwritten, and the array exposed uninitialized heap memory (with the items misplaced) on a successful return. Fill the fixed slot old_size + i instead, and raise RuntimeError if self is resized mid-iteration, mirroring the existing list-mutation guard. This is distinct from pythongh-144128/pythongh-144138, which fixed a use-after-free in the *_setitem conversion helpers and did not touch fromlist's index logic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the uninitialized-memory exposure in
array.array.fromlist()reported in #152166.fromlist()preallocatednslots witharray_resize(self, old_size + n)and then filled them atPy_SIZE(self) - n + i, recomputed from the livePy_SIZEeach iteration, while only guarding against the source list changing size. When an element's__index__resizedselfas a side effect of thesetitemcallback, the write index slid forward, the reserved slots were left unwritten, and the array returned uninitialized heap memory (with the real items misplaced) on a successful return —array_resizeusesPyMem_RESIZEwith no zeroing.This writes the reserved slot
old_size + idirectly and raisesRuntimeError("array changed size during iteration")ifselfis resized mid-iteration, mirroring the adjacent list-mutation guard.Distinct from #144128 / #144138, which fixed a use-after-free in the
II/LL/QQ_setitem conversion helpers and did not touchfromlist's index logic; this defect remained onmain.Before
After
Adds a regression test (
test_fromlist_reentrant_self_resize) covering grow and shrink across the signed/unsigned integer typecodes.