BUG? get_nbo_cast_transfer_function creates garbage arrays which are passed into the ->getitem function

[eric-wieser]

Raised in the comments of #11669.

The offending code is:

numpy/numpy/core/src/multiarray/dtype_transfer.c

Lines 1436 to 1489 in da5eaf9

	/*
	* TODO: This is a hack so the cast functions have an array.
	* The cast functions shouldn't need that. Also, since we
	* always handle byte order conversions, this array should
	* have native byte order.
	*/
	if (PyArray_ISNBO(src_dtype->byteorder)) {
	tmp_dtype = src_dtype;
	Py_INCREF(tmp_dtype);
	}
	else {
	tmp_dtype = PyArray_DescrNewByteorder(src_dtype, NPY_NATIVE);
	if (tmp_dtype == NULL) {
	PyArray_free(data);
	return NPY_FAIL;
	}
	}
	data->aip = (PyArrayObject *)PyArray_NewFromDescr_int(
	&PyArray_Type, tmp_dtype,
	1, &shape, NULL, NULL,
	0, NULL, NULL,
	0, 1);
	if (data->aip == NULL) {
	PyArray_free(data);
	return NPY_FAIL;
	}
	/*
	* TODO: This is a hack so the cast functions have an array.
	* The cast functions shouldn't need that. Also, since we
	* always handle byte order conversions, this array should
	* have native byte order.
	*/
	if (PyArray_ISNBO(dst_dtype->byteorder)) {
	tmp_dtype = dst_dtype;
	Py_INCREF(tmp_dtype);
	}
	else {
	tmp_dtype = PyArray_DescrNewByteorder(dst_dtype, NPY_NATIVE);
	if (tmp_dtype == NULL) {
	Py_DECREF(data->aip);
	PyArray_free(data);
	return NPY_FAIL;
	}
	}
	data->aop = (PyArrayObject *)PyArray_NewFromDescr_int(
	&PyArray_Type, tmp_dtype,
	1, &shape, NULL, NULL,
	0, NULL, NULL,
	0, 1);
	if (data->aop == NULL) {
	Py_DECREF(data->aip);
	PyArray_free(data);
	return NPY_FAIL;
	}

data->aip goes on to be passed to PyArray_ArrFuncs::getitem in VOID_to_OBJECT , even though it is not attached to the actual array that is being copied from.

I'd assumed the contract of PyArray_ArrFuncs::getitem was that the aip argument was always the container of the passed ip argument, but it seems we violate that.