Py_BuildValue is causing crashes with the "L" and "K" format characters when upcasting sub 64-bit integer types

[mr-nfamous]

BPO	33279
Nosy	@pfmoore, @tjguk, @zware, @serhiy-storchaka, @zooba, @mr-nfamous

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2018-04-14.18:46:04.685>
created_at = <Date 2018-04-14.18:32:00.842>
labels = ['interpreter-core', 'invalid', 'OS-windows', 'type-crash']
title = 'Py_BuildValue is causing crashes with the "L" and "K" format characters when upcasting sub 64-bit integer types'
updated_at = <Date 2018-04-14.18:46:04.678>
user = 'https://github.com/mr-nfamous'

bugs.python.org fields:

activity = <Date 2018-04-14.18:46:04.678>
actor = 'serhiy.storchaka'
assignee = 'none'
closed = True
closed_date = <Date 2018-04-14.18:46:04.685>
closer = 'serhiy.storchaka'
components = ['Interpreter Core', 'Windows']
creation = <Date 2018-04-14.18:32:00.842>
creator = 'bup'
dependencies = []
files = []
hgrepos = []
issue_num = 33279
keywords = []
message_count = 2.0
messages = ['315300', '315301']
nosy_count = 6.0
nosy_names = ['paul.moore', 'tim.golden', 'zach.ware', 'serhiy.storchaka', 'steve.dower', 'bup']
pr_nums = []
priority = 'normal'
resolution = 'not a bug'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue33279'
versions = ['Python 3.6']

[mr-nfamous]

New to both C and the CPython api so I'm not sure what compiler details matter but this is with VS14 and default compile parameters on windows 10 with 32bit Python.

The following function:

static PyObject *spam(PyObject *module) {
    digit w = 9;
    int x = 9;
    long y = 9;
    int32_t z = 9;
    return Py_BuildValue("(HIK)(lll)(LLL)", w,w,w,x,y,z,x,y,z);  
}

returns:

>>> spam()
((9, 9, 38654705673), (9, 9, 9), (38654705673, 438244858264171835, 6133859984))

Above was the most I could fit in a single Py_BuildValue call without causing a crash (it instantly crashes if "O" or "N" fields are present). I believe this happens because the ints are being upcasted as pointers, which is undefined behavior.

[serhiy-storchaka]

This isn't a bug in CPython API. You need to pass arguments of correct type to functions with a variable number of parameters. The compiler doesn't know what type is expected and can't coerce the value automatically. The same undefined behavior your can see with say printf().