From 350a6e751d0c919f016989aeeae45ecdaffcc854 Mon Sep 17 00:00:00 2001
From: sobolevn <mail@sobolevn.me>
Date: Wed, 31 Jan 2024 15:44:21 +0300
Subject: [PATCH] gh-114685: `PyBuffer_FillInfo` now raises on
 `PyBUF_{READ,WRITE}`

---
 Lib/test/test_buffer.py                       | 13 ++++++++++++
 ...-01-31-15-43-35.gh-issue-114685.n7aRmX.rst |  3 +++
 Modules/_testcapimodule.c                     | 20 +++++++++++++++++++
 Objects/abstract.c                            | 16 ++++++++++-----
 4 files changed, 47 insertions(+), 5 deletions(-)
 create mode 100644 Misc/NEWS.d/next/C API/2024-01-31-15-43-35.gh-issue-114685.n7aRmX.rst

diff --git a/Lib/test/test_buffer.py b/Lib/test/test_buffer.py
index 535b795f508a242..2c15b6169f33d33 100644
--- a/Lib/test/test_buffer.py
+++ b/Lib/test/test_buffer.py
@@ -4591,6 +4591,19 @@ def test_c_buffer_invalid_flags(self):
         self.assertRaises(SystemError, buf.__buffer__, PyBUF_READ)
         self.assertRaises(SystemError, buf.__buffer__, PyBUF_WRITE)
 
+    @unittest.skipIf(_testcapi is None, "requires _testcapi")
+    def test_c_fill_buffer_invalid_flags(self):
+        # PyBuffer_FillInfo
+        self.assertRaises(SystemError, _testcapi.buffer_fill_info,
+                          "abc", 0, PyBUF_READ)
+        self.assertRaises(SystemError, _testcapi.buffer_fill_info,
+                          "abc", 0, PyBUF_WRITE)
+
+    @unittest.skipIf(_testcapi is None, "requires _testcapi")
+    def test_c_fill_buffer_readonly_and_writable(self):
+        self.assertRaises(BufferError, _testcapi.buffer_fill_info,
+                          "abc", 1, PyBUF_WRITABLE)
+
     def test_inheritance(self):
         class A(bytearray):
             def __buffer__(self, flags):
diff --git a/Misc/NEWS.d/next/C API/2024-01-31-15-43-35.gh-issue-114685.n7aRmX.rst b/Misc/NEWS.d/next/C API/2024-01-31-15-43-35.gh-issue-114685.n7aRmX.rst
new file mode 100644
index 000000000000000..76ff00645fe57d2
--- /dev/null
+++ b/Misc/NEWS.d/next/C API/2024-01-31-15-43-35.gh-issue-114685.n7aRmX.rst	
@@ -0,0 +1,3 @@
+:c:func:`PyBuffer_FillInfo` now raises a :exc:`SystemError` if called with
+:c:macro:`PyBUF_READ` or :c:macro:`PyBUF_WRITE` as flags. These flags should
+only be used with the ``PyMemoryView_*`` C API.
diff --git a/Modules/_testcapimodule.c b/Modules/_testcapimodule.c
index 6def680190b1a63..8f795077d268015 100644
--- a/Modules/_testcapimodule.c
+++ b/Modules/_testcapimodule.c
@@ -1261,6 +1261,25 @@ make_memoryview_from_NULL_pointer(PyObject *self, PyObject *Py_UNUSED(ignored))
     return PyMemoryView_FromBuffer(&info);
 }
 
+static PyObject *
+buffer_fill_info(PyObject *self, PyObject *args)
+{
+    Py_buffer info;
+    const char *data;
+    Py_ssize_t size;
+    int readonly;
+    int flags;
+
+    if (!PyArg_ParseTuple(args, "s#ii:buffer_fill_info",
+                          &data, &size, &readonly, &flags)) {
+        return NULL;
+    }
+
+    if (PyBuffer_FillInfo(&info, NULL, (void *)data, size, readonly, flags) < 0)
+        return NULL;
+    return PyMemoryView_FromBuffer(&info);
+}
+
 static PyObject *
 test_from_contiguous(PyObject* self, PyObject *Py_UNUSED(ignored))
 {
@@ -3314,6 +3333,7 @@ static PyMethodDef TestMethods[] = {
     {"eval_code_ex",            eval_eval_code_ex,               METH_VARARGS},
     {"make_memoryview_from_NULL_pointer", make_memoryview_from_NULL_pointer,
      METH_NOARGS},
+    {"buffer_fill_info",        buffer_fill_info,                METH_VARARGS},
     {"crash_no_current_thread", crash_no_current_thread,         METH_NOARGS},
     {"test_current_tstate_matches", test_current_tstate_matches, METH_NOARGS},
     {"run_in_subinterp",        run_in_subinterp,                METH_VARARGS},
diff --git a/Objects/abstract.c b/Objects/abstract.c
index daf04eb4ab2cda3..07d4b89fe188c84 100644
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -767,11 +767,17 @@ PyBuffer_FillInfo(Py_buffer *view, PyObject *obj, void *buf, Py_ssize_t len,
         return -1;
     }
 
-    if (((flags & PyBUF_WRITABLE) == PyBUF_WRITABLE) &&
-        (readonly == 1)) {
-        PyErr_SetString(PyExc_BufferError,
-                        "Object is not writable.");
-        return -1;
+    if (flags != PyBUF_SIMPLE) {  /* fast path */
+        if (flags == PyBUF_READ || flags == PyBUF_WRITE) {
+            PyErr_BadInternalCall();
+            return -1;
+        }
+        if (((flags & PyBUF_WRITABLE) == PyBUF_WRITABLE) &&
+            (readonly == 1)) {
+            PyErr_SetString(PyExc_BufferError,
+                            "Object is not writable.");
+            return -1;
+        }
     }
 
     view->obj = Py_XNewRef(obj);