Skip to content

AtomMethodWrapper tp_basicsize uses sizeof(MethodWrapper) instead of sizeof(AtomMethodWrapper) #255

@devdanzin

Description

@devdanzin

AtomMethodWrapper's PyType_Spec at methodwrapper.cpp:213 specifies sizeof(MethodWrapper) as tp_basicsize. But AtomMethodWrapper has a CAtomPointer pointer member that MethodWrapper does not:

struct MethodWrapper {
    PyObject_HEAD
    PyObject* im_func;
    PyObject* im_selfref;
};

struct AtomMethodWrapper {
    PyObject_HEAD
    PyObject* im_func;
    CAtomPointer pointer;  // additional member
};

Currently both structs happen to be the same size (one PyObject* vs one CAtomPointer which contains a CAtom*), so this is accidentally benign. But it is clearly a copy-paste bug from the MethodWrapper spec, and if the structs ever diverge in size, PyType_GenericNew would allocate too little memory and new(&wrapper->pointer) CAtomPointer(...) at methodwrapper.cpp:252 would write past the allocated block — heap buffer overflow.

Fix (methodwrapper.cpp:213):

PyType_Spec AtomMethodWrapper::TypeObject_Spec = {
    PACKAGE_TYPENAME( "AtomMethodWrapper" ),
    sizeof( AtomMethodWrapper ),    // was sizeof( MethodWrapper )
    0,
    Py_TPFLAGS_DEFAULT,
    AtomMethodWrapper_Type_slots
};

Found by cext-review-toolkit.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions