memcpy writes to wrong destination

[drewbenn]

BPO	43363
Nosy	@serhiy-storchaka, @MojoVampire, @drewbenn

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2021-03-03.02:56:46.512>
created_at = <Date 2021-03-02.04:06:12.562>
labels = ['extension-modules', 'invalid', '3.8', '3.9', '3.10']
title = 'memcpy writes to wrong destination'
updated_at = <Date 2021-03-03.02:56:46.509>
user = 'https://github.com/drewbenn'

bugs.python.org fields:

activity = <Date 2021-03-03.02:56:46.509>
actor = 'josh.r'
assignee = 'none'
closed = True
closed_date = <Date 2021-03-03.02:56:46.512>
closer = 'josh.r'
components = ['Extension Modules']
creation = <Date 2021-03-02.04:06:12.562>
creator = 'drewbenn'
dependencies = []
files = []
hgrepos = []
issue_num = 43363
keywords = []
message_count = 3.0
messages = ['387899', '387913', '387994']
nosy_count = 3.0
nosy_names = ['serhiy.storchaka', 'josh.r', 'drewbenn']
pr_nums = []
priority = 'normal'
resolution = 'not a bug'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue43363'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']

[drewbenn]

In Modules/_functoolsmodule.c's partial_vectorcall(), there are two consecutive memcpys:

memcpy(stack, pto_args, pto_nargs * sizeof(PyObject*));
memcpy(stack + pto_nargs, args, nargs_total * sizeof(PyObject*));

The second should copy to stack + pto_nargs * sizeof(PyObject*). As-is, the code will work correctly unless both pto_nargs and nargs_total are non-zero.

[serhiy-storchaka]

The code looks correct to me. Note that the stack variable has type PyObject**, so stack + pto_nargs is equal to (PyObject**)((char *)stack + pto_nargs*sizeof(PyObject*)).

Did I missed something?

[MojoVampire]

Agreed, stack is a PyObject**, so adding an integer (pto_nargs) to the pointer (stack) is implicitly by multiples of sizeof(PyObject*). This is how pointer arithmetic works in all versions of C I'm aware of. The code is correct.