Thanks to visit codestin.com
Credit goes to github.com

Skip to content

gh-142555: Fix null pointer dereference in array.__setitem__ via re-entrant __index__ #142713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
encukou merged 22 commits into from
Feb 2, 2026
Merged

gh-142555: Fix null pointer dereference in array.__setitem__ via re-entrant __index__ #142713

Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
71fc725
Fix null pointer dereference in array.__setitem__ via re-entrant __in…
aisk Dec 14, 2025
6c437d5
Update Misc/NEWS.d/next/Core_and_Builtins/2025-12-15-02-02-45.gh-issu…
aisk Dec 15, 2025
e3c728a
Move the news entry to library folder
aisk Dec 15, 2025
67e98b5
Also check if the ob_item's size is changed by user's code
aisk Dec 17, 2025
ad18d48
Add check on more *_setitem methods
aisk Dec 17, 2025
c408c57
Check other setitem methods
aisk Dec 18, 2025
95e4eec
Reduce the comments
aisk Dec 18, 2025
fc6f987
Re-order the test
aisk Dec 18, 2025
c8cbd28
Refactor the array check codes to a function
aisk Dec 19, 2025
0b3db3c
Change the bound check from function to macro
aisk Dec 20, 2025
8eeba89
Revert the format changed made by IDE automatically
aisk Dec 20, 2025
e00b7a4
Revert more format changes
aisk Dec 20, 2025
2b6d5dc
Revert more format changes
aisk Dec 20, 2025
c83b64a
Revert more format test
aisk Dec 20, 2025
d0ff678
Update news entry
aisk Dec 20, 2025
e865d0d
Update Misc/NEWS.d/next/Library/2025-12-15-02-02-45.gh-issue-142555.E…
aisk Dec 27, 2025
0ad0f28
Refactor tests
aisk Dec 27, 2025
b3617c8
Format the macro by PEP7
aisk Dec 27, 2025
deccbf0
Update by review comments
aisk Dec 27, 2025
a4dab68
Simplify the test
aisk Dec 27, 2025
1befa98
Update comment
aisk Dec 27, 2025
37ed8f8
Update Lib/test/test_array.py
aisk Dec 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Change the bound check from function to macro
  • Loading branch information
@aisk
aisk committed Dec 20, 2025
commit 0b3db3c71262fbe1546cc2cba15d8a8a41b239bf
92 changes: 34 additions & 58 deletions Modules/arraymodule.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,19 +205,28 @@ Note that the basic Get and Set functions do NOT check that the index is
in bounds; that's the responsibility of the caller.
****************************************************************************/

/* Check array buffer validity and bounds after calling user-defined methods
(like __index__ or __float__) that might modify the array during the call.
Returns false on error, true on success. */
static inline bool
array_check_bounds_after_user_call(arrayobject *ap, Py_ssize_t i)
{
if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
PyErr_SetString(PyExc_IndexError,
"array assignment index out of range");
return false;
}
return true;
}
/* Macro to check array buffer validity and bounds after calling
user-defined methods (like __index__ or __float__) that might modify
the array during the call.
*/
#define CHECK_ARRAY_BOUNDS(ap, i) \
do { \
if ((i) >= 0 && ((ap)->ob_item == NULL || (i) >= Py_SIZE((ap)))) { \
PyErr_SetString(PyExc_IndexError, "array assignment index out of range"); \
return -1; \
} \
} while (0)
Comment thread
aisk marked this conversation as resolved.
Outdated

#define CHECK_ARRAY_BOUNDS_WITH_CLEANUP(ap, i, v, cleanup) \
do { \
if ((i) >= 0 && ((ap)->ob_item == NULL || (i) >= Py_SIZE((ap)))) { \
PyErr_SetString(PyExc_IndexError, "array assignment index out of range"); \
if (cleanup) { \
Py_DECREF(v); \
} \
return -1; \
} \
} while (0)

static PyObject *
b_getitem(arrayobject *ap, Py_ssize_t i)
Expand All @@ -236,9 +245,7 @@ b_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "h;array item must be integer", &x))
return -1;

if (!array_check_bounds_after_user_call(ap, i)) {
return -1;
}
CHECK_ARRAY_BOUNDS(ap, i);

if (x < -128) {
PyErr_SetString(PyExc_OverflowError,
Expand Down Expand Up @@ -270,9 +277,7 @@ BB_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "b;array item must be integer", &x))
return -1;

if (!array_check_bounds_after_user_call(ap, i)) {
return -1;
}
CHECK_ARRAY_BOUNDS(ap, i);

if (i >= 0)
((unsigned char *)ap->ob_item)[i] = x;
Expand Down Expand Up @@ -367,9 +372,7 @@ h_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "h;array item must be integer", &x))
return -1;

if (!array_check_bounds_after_user_call(ap, i)) {
return -1;
}
CHECK_ARRAY_BOUNDS(ap, i);

if (i >= 0)
((short *)ap->ob_item)[i] = x;
Expand Down Expand Up @@ -401,9 +404,7 @@ HH_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
return -1;
}

if (!array_check_bounds_after_user_call(ap, i)) {
return -1;
}
CHECK_ARRAY_BOUNDS(ap, i);

if (i >= 0)
((short *)ap->ob_item)[i] = (short)x;
Expand All @@ -424,9 +425,7 @@ i_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "i;array item must be integer", &x))
return -1;

if (!array_check_bounds_after_user_call(ap, i)) {
return -1;
}
CHECK_ARRAY_BOUNDS(ap, i);

if (i >= 0)
((int *)ap->ob_item)[i] = x;
Expand Down Expand Up @@ -469,12 +468,7 @@ II_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
return -1;
}

if (!array_check_bounds_after_user_call(ap, i)) {
if (do_decref) {
Py_DECREF(v);
}
return -1;
}
CHECK_ARRAY_BOUNDS_WITH_CLEANUP(ap, i, v, do_decref);

if (i >= 0)
((unsigned int *)ap->ob_item)[i] = (unsigned int)x;
Expand All @@ -498,9 +492,7 @@ l_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "l;array item must be integer", &x))
return -1;

if (!array_check_bounds_after_user_call(ap, i)) {
return -1;
}
CHECK_ARRAY_BOUNDS(ap, i);

if (i >= 0)
((long *)ap->ob_item)[i] = x;
Expand Down Expand Up @@ -534,12 +526,7 @@ LL_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
return -1;
}

if (!array_check_bounds_after_user_call(ap, i)) {
if (do_decref) {
Py_DECREF(v);
}
return -1;
}
CHECK_ARRAY_BOUNDS_WITH_CLEANUP(ap, i, v, do_decref);

if (i >= 0)
((unsigned long *)ap->ob_item)[i] = x;
Expand All @@ -563,9 +550,7 @@ q_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "L;array item must be integer", &x))
return -1;

if (!array_check_bounds_after_user_call(ap, i)) {
return -1;
}
CHECK_ARRAY_BOUNDS(ap, i);

if (i >= 0)
((long long *)ap->ob_item)[i] = x;
Expand Down Expand Up @@ -600,12 +585,7 @@ QQ_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
return -1;
}

if (!array_check_bounds_after_user_call(ap, i)) {
if (do_decref) {
Py_DECREF(v);
}
return -1;
}
CHECK_ARRAY_BOUNDS_WITH_CLEANUP(ap, i, v, do_decref);

if (i >= 0)
((unsigned long long *)ap->ob_item)[i] = x;
Expand All @@ -629,9 +609,7 @@ f_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "f;array item must be float", &x))
return -1;

if (!array_check_bounds_after_user_call(ap, i)) {
return -1;
}
CHECK_ARRAY_BOUNDS(ap, i);

if (i >= 0)
((float *)ap->ob_item)[i] = x;
Expand All @@ -651,9 +629,7 @@ d_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
if (!PyArg_Parse(v, "d;array item must be float", &x))
return -1;

if (!array_check_bounds_after_user_call(ap, i)) {
return -1;
}
CHECK_ARRAY_BOUNDS(ap, i);

if (i >= 0)
((double *)ap->ob_item)[i] = x;
Expand Down
Loading