_imp.get_frozen_object possible incorrect use of PyBUF_READ

[sobolevn]

Bug report

It is documented that PyBUF_READ should be used with memoryview objects. But, it is used in PyObject_GetBuffer:

cpython/Python/import.c

Line 3547 in 5ecfd75

if (PyObject_GetBuffer(dataobj, &buf, PyBUF_READ) != 0) {

Other similar places that access .buf and .len just use PyBUF_SIMPLE, which I think we should use here as well.

I will send a PR.

Originally found by @serhiy-storchaka in #114669 (comment)

Linked PRs

• gh-114685: Fix incorrect use of PyBUF_READ in import.c #114686
• [3.12] gh-114685: Fix incorrect use of PyBUF_READ in import.c (GH-114686) #114700
• [3.11] gh-114685: Fix incorrect use of PyBUF_READ in import.c (GH-114686) #114701
• gh-114685: Check flags in PyObject_GetBuffer() #114707
• gh-114685: PyBuffer_FillInfo now raises on PyBUF_{READ,WRITE} #114802

[serhiy-storchaka]

Other question, why it was not caught in tests? Does PyObject_GetBuffer() ignore unknown flags or this code was never executed?

[sobolevn]

PyObject_GetBuffer() expects a numeric flag, but it uses bitflag model with example logic:

    if (!REQ_FORMAT(flags)) {
        /* NULL indicates that the buffer's data type has been cast to 'B'.
           view->itemsize is the _previous_ itemsize. If shape is present,
           the equality product(shape) * itemsize = len still holds at this
           point. The equality calcsize(format) = itemsize does _not_ hold
           from here on! */
        view->format = NULL;
    }
    if (REQ_C_CONTIGUOUS(flags) && !MV_C_CONTIGUOUS(baseflags)) {
        PyErr_SetString(PyExc_BufferError,
            "memoryview: underlying buffer is not C-contiguous");
        return -1;
    }
    if (REQ_F_CONTIGUOUS(flags) && !MV_F_CONTIGUOUS(baseflags)) {
        PyErr_SetString(PyExc_BufferError,
            "memoryview: underlying buffer is not Fortran contiguous");
        return -1;
    }
    if (REQ_ANY_CONTIGUOUS(flags) && !MV_ANY_CONTIGUOUS(baseflags)) {
        PyErr_SetString(PyExc_BufferError,
            "memoryview: underlying buffer is not contiguous");
        return -1;
    }

PyBYF_READ is equal to 256, so it just contains all the features. PyBUF_SIMPLE is just 0, so no extras.

[serhiy-storchaka]

Unfortunately the value of PyBUF_READ intersects with PyBUF_INDIRECT, PyBUF_FULL and PyBUF_FULL_RO, so we cannot just ban this bit. But fortunately other values has other bits set, so this error is still distinguishable.

[sobolevn]

What about PyBuffer_FillInfo(Py_buffer *view, PyObject *obj, void *buf, Py_ssize_t len, int readonly, int flags)? Do we need to check flags there as well?

[serhiy-storchaka]

Maybe. We do not have examples of the misuse in this case, and it is much less used, but a similar error is possible here too.

[sobolevn]

I will send an example PR, so we can decide 👍