A possible double decref in _ctypes.c's PyCArrayType_new()

[ZackerySpytz]

BPO	36421
Nosy	@vstinner, @serhiy-storchaka, @matrixise, @ZackerySpytz, @miss-islington
PRs	bpo-36421: Fix a possible double decref in _ctypes.c's PyCArrayType_new() #12530 [3.7] bpo-36421: Fix a possible double decref in _ctypes.c's PyCArrayType_new(). (GH-12530) #12533 [2.7] bpo-36421: Fix ref counting bugs in _ctypes.c's PyCArrayType_new() #12534

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2019-03-25.14:16:30.219>
created_at = <Date 2019-03-25.03:31:24.056>
labels = ['extension-modules', 'ctypes', '3.7', '3.8']
title = "A possible double decref in _ctypes.c's PyCArrayType_new()"
updated_at = <Date 2019-06-04.16:18:11.784>
user = 'https://github.com/ZackerySpytz'

bugs.python.org fields:

activity = <Date 2019-06-04.16:18:11.784>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2019-03-25.14:16:30.219>
closer = 'serhiy.storchaka'
components = ['Extension Modules', 'ctypes']
creation = <Date 2019-03-25.03:31:24.056>
creator = 'ZackerySpytz'
dependencies = []
files = []
hgrepos = []
issue_num = 36421
keywords = ['patch']
message_count = 6.0
messages = ['338779', '338782', '338787', '338791', '338798', '344598']
nosy_count = 5.0
nosy_names = ['vstinner', 'serhiy.storchaka', 'matrixise', 'ZackerySpytz', 'miss-islington']
pr_nums = ['12530', '12533', '12534']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue36421'
versions = ['Python 2.7', 'Python 3.7', 'Python 3.8']

[ZackerySpytz]

In PyCArrayType_new(), type_attr is assigned to stgdict->proto. If the PyDict_Update() call fails in that function, type_attr will be decrefed an extra time when stgdict is deallocated.

I'll create a PR for this issue.

[matrixise]

Hi Zackery,

just one question, how did you detect this bug? in reading the code,
with a tool (valgrind or sanitizer) or with a test?

Have a nice day and thank you for the clarification.

[serhiy-storchaka]

New changeset 5e33378 by Serhiy Storchaka (Zackery Spytz) in branch 'master':
bpo-36421: Fix a possible double decref in _ctypes.c's PyCArrayType_new(). (GH-12530)
5e33378

[miss-islington]

New changeset fa27870 by Miss Islington (bot) in branch '3.7':
bpo-36421: Fix a possible double decref in _ctypes.c's PyCArrayType_new(). (GH-12530)
fa27870

[serhiy-storchaka]

New changeset 0516f81 by Serhiy Storchaka (Zackery Spytz) in branch '2.7':
[2.7] bpo-36421: Fix ref counting bugs in _ctypes.c's PyCArrayType_new(). (GH-12534)
0516f81

[vstinner]

just one question, how did you detect this bug?

I bet that Zackery Spytz used Svace static analyzer: http://www.ispras.ru/en/technologies/svace/

See also: https://python-security.readthedocs.io/security.html#static-analysers-of-cpython-code-base