Skip to content

Commit

Permalink
gh-111178: fix UBSan failures in Python/bltinmodule.c (GH-128235)
Browse files Browse the repository at this point in the history 
* fix UBSan failures for `filterobject`
* fix UBSan failures for `mapobject`
* fix UBSan failures for `zipobject`
  • Loading branch information
@picnixz
picnixz authored Jan 10, 2025
1 parent 613240b commit 28ffdc5
Showing 1 changed file with 51 additions and 30 deletions.
81 changes: 51 additions & 30 deletions Python/bltinmodule.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -494,6 +494,8 @@ typedef struct {
PyObject *it;
} filterobject;

#define _filterobject_CAST(op) ((filterobject *)(op))

static PyObject *
filter_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
{
Expand Down Expand Up @@ -559,8 +561,9 @@ filter_vectorcall(PyObject *type, PyObject * const*args,
}

static void
filter_dealloc(filterobject *lz)
filter_dealloc(PyObject *self)
{
filterobject *lz = _filterobject_CAST(self);
PyObject_GC_UnTrack(lz);
Py_TRASHCAN_BEGIN(lz, filter_dealloc)
Py_XDECREF(lz->func);
Expand All @@ -570,16 +573,18 @@ filter_dealloc(filterobject *lz)
}

static int
filter_traverse(filterobject *lz, visitproc visit, void *arg)
filter_traverse(PyObject *self, visitproc visit, void *arg)
{
filterobject *lz = _filterobject_CAST(self);
Py_VISIT(lz->it);
Py_VISIT(lz->func);
return 0;
}

static PyObject *
filter_next(filterobject *lz)
filter_next(PyObject *self)
{
filterobject *lz = _filterobject_CAST(self);
PyObject *item;
PyObject *it = lz->it;
long ok;
Expand Down Expand Up @@ -613,15 +618,16 @@ filter_next(filterobject *lz)
}

static PyObject *
filter_reduce(filterobject *lz, PyObject *Py_UNUSED(ignored))
filter_reduce(PyObject *self, PyObject *Py_UNUSED(ignored))
{
filterobject *lz = _filterobject_CAST(self);
return Py_BuildValue("O(OO)", Py_TYPE(lz), lz->func, lz->it);
}

PyDoc_STRVAR(reduce_doc, "Return state information for pickling.");

static PyMethodDef filter_methods[] = {
{"__reduce__", _PyCFunction_CAST(filter_reduce), METH_NOARGS, reduce_doc},
{"__reduce__", filter_reduce, METH_NOARGS, reduce_doc},
{NULL, NULL} /* sentinel */
};

Expand All @@ -638,7 +644,7 @@ PyTypeObject PyFilter_Type = {
sizeof(filterobject), /* tp_basicsize */
0, /* tp_itemsize */
/* methods */
(destructor)filter_dealloc, /* tp_dealloc */
filter_dealloc, /* tp_dealloc */
0, /* tp_vectorcall_offset */
0, /* tp_getattr */
0, /* tp_setattr */
Expand All @@ -656,12 +662,12 @@ PyTypeObject PyFilter_Type = {
Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
Py_TPFLAGS_BASETYPE, /* tp_flags */
filter_doc, /* tp_doc */
(traverseproc)filter_traverse, /* tp_traverse */
filter_traverse, /* tp_traverse */
0, /* tp_clear */
0, /* tp_richcompare */
0, /* tp_weaklistoffset */
PyObject_SelfIter, /* tp_iter */
(iternextfunc)filter_next, /* tp_iternext */
filter_next, /* tp_iternext */
filter_methods, /* tp_methods */
0, /* tp_members */
0, /* tp_getset */
Expand All @@ -674,7 +680,7 @@ PyTypeObject PyFilter_Type = {
PyType_GenericAlloc, /* tp_alloc */
filter_new, /* tp_new */
PyObject_GC_Del, /* tp_free */
.tp_vectorcall = (vectorcallfunc)filter_vectorcall
.tp_vectorcall = filter_vectorcall
};


Expand Down Expand Up @@ -1319,6 +1325,8 @@ typedef struct {
int strict;
} mapobject;

#define _mapobject_CAST(op) ((mapobject *)(op))

static PyObject *
map_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
{
Expand Down Expand Up @@ -1422,25 +1430,28 @@ map_vectorcall(PyObject *type, PyObject * const*args,
}

static void
map_dealloc(mapobject *lz)
map_dealloc(PyObject *self)
{
mapobject *lz = _mapobject_CAST(self);
PyObject_GC_UnTrack(lz);
Py_XDECREF(lz->iters);
Py_XDECREF(lz->func);
Py_TYPE(lz)->tp_free(lz);
}

static int
map_traverse(mapobject *lz, visitproc visit, void *arg)
map_traverse(PyObject *self, visitproc visit, void *arg)
{
mapobject *lz = _mapobject_CAST(self);
Py_VISIT(lz->iters);
Py_VISIT(lz->func);
return 0;
}

static PyObject *
map_next(mapobject *lz)
map_next(PyObject *self)
{
mapobject *lz = _mapobject_CAST(self);
Py_ssize_t i;
PyObject *small_stack[_PY_FASTCALL_SMALL_STACK];
PyObject **stack;
Expand Down Expand Up @@ -1523,8 +1534,9 @@ map_next(mapobject *lz)
}

static PyObject *
map_reduce(mapobject *lz, PyObject *Py_UNUSED(ignored))
map_reduce(PyObject *self, PyObject *Py_UNUSED(ignored))
{
mapobject *lz = _mapobject_CAST(self);
Py_ssize_t numargs = PyTuple_GET_SIZE(lz->iters);
PyObject *args = PyTuple_New(numargs+1);
Py_ssize_t i;
Expand All @@ -1545,19 +1557,20 @@ map_reduce(mapobject *lz, PyObject *Py_UNUSED(ignored))
PyDoc_STRVAR(setstate_doc, "Set state information for unpickling.");

static PyObject *
map_setstate(mapobject *lz, PyObject *state)
map_setstate(PyObject *self, PyObject *state)
{
int strict = PyObject_IsTrue(state);
if (strict < 0) {
return NULL;
}
mapobject *lz = _mapobject_CAST(self);
lz->strict = strict;
Py_RETURN_NONE;
}

static PyMethodDef map_methods[] = {
{"__reduce__", _PyCFunction_CAST(map_reduce), METH_NOARGS, reduce_doc},
{"__setstate__", _PyCFunction_CAST(map_setstate), METH_O, setstate_doc},
{"__reduce__", map_reduce, METH_NOARGS, reduce_doc},
{"__setstate__", map_setstate, METH_O, setstate_doc},
{NULL, NULL} /* sentinel */
};

Expand All @@ -1578,7 +1591,7 @@ PyTypeObject PyMap_Type = {
sizeof(mapobject), /* tp_basicsize */
0, /* tp_itemsize */
/* methods */
(destructor)map_dealloc, /* tp_dealloc */
map_dealloc, /* tp_dealloc */
0, /* tp_vectorcall_offset */
0, /* tp_getattr */
0, /* tp_setattr */
Expand All @@ -1596,12 +1609,12 @@ PyTypeObject PyMap_Type = {
Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
Py_TPFLAGS_BASETYPE, /* tp_flags */
map_doc, /* tp_doc */
(traverseproc)map_traverse, /* tp_traverse */
map_traverse, /* tp_traverse */
0, /* tp_clear */
0, /* tp_richcompare */
0, /* tp_weaklistoffset */
PyObject_SelfIter, /* tp_iter */
(iternextfunc)map_next, /* tp_iternext */
map_next, /* tp_iternext */
map_methods, /* tp_methods */
0, /* tp_members */
0, /* tp_getset */
Expand All @@ -1614,7 +1627,7 @@ PyTypeObject PyMap_Type = {
PyType_GenericAlloc, /* tp_alloc */
map_new, /* tp_new */
PyObject_GC_Del, /* tp_free */
.tp_vectorcall = (vectorcallfunc)map_vectorcall
.tp_vectorcall = map_vectorcall
};


Expand Down Expand Up @@ -2965,6 +2978,8 @@ typedef struct {
int strict;
} zipobject;

#define _zipobject_CAST(op) ((zipobject *)(op))

static PyObject *
zip_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
{
Expand Down Expand Up @@ -3033,25 +3048,29 @@ zip_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
}

static void
zip_dealloc(zipobject *lz)
zip_dealloc(PyObject *self)
{
zipobject *lz = _zipobject_CAST(self);
PyObject_GC_UnTrack(lz);
Py_XDECREF(lz->ittuple);
Py_XDECREF(lz->result);
Py_TYPE(lz)->tp_free(lz);
}

static int
zip_traverse(zipobject *lz, visitproc visit, void *arg)
zip_traverse(PyObject *self, visitproc visit, void *arg)
{
zipobject *lz = _zipobject_CAST(self);
Py_VISIT(lz->ittuple);
Py_VISIT(lz->result);
return 0;
}

static PyObject *
zip_next(zipobject *lz)
zip_next(PyObject *self)
{
zipobject *lz = _zipobject_CAST(self);

Py_ssize_t i;
Py_ssize_t tuplesize = lz->tuplesize;
PyObject *result = lz->result;
Expand Down Expand Up @@ -3141,8 +3160,9 @@ zip_next(zipobject *lz)
}

static PyObject *
zip_reduce(zipobject *lz, PyObject *Py_UNUSED(ignored))
zip_reduce(PyObject *self, PyObject *Py_UNUSED(ignored))
{
zipobject *lz = _zipobject_CAST(self);
/* Just recreate the zip with the internal iterator tuple */
if (lz->strict) {
return PyTuple_Pack(3, Py_TYPE(lz), lz->ittuple, Py_True);
Expand All @@ -3151,19 +3171,20 @@ zip_reduce(zipobject *lz, PyObject *Py_UNUSED(ignored))
}

static PyObject *
zip_setstate(zipobject *lz, PyObject *state)
zip_setstate(PyObject *self, PyObject *state)
{
int strict = PyObject_IsTrue(state);
if (strict < 0) {
return NULL;
}
zipobject *lz = _zipobject_CAST(self);
lz->strict = strict;
Py_RETURN_NONE;
}

static PyMethodDef zip_methods[] = {
{"__reduce__", _PyCFunction_CAST(zip_reduce), METH_NOARGS, reduce_doc},
{"__setstate__", _PyCFunction_CAST(zip_setstate), METH_O, setstate_doc},
{"__reduce__", zip_reduce, METH_NOARGS, reduce_doc},
{"__setstate__", zip_setstate, METH_O, setstate_doc},
{NULL} /* sentinel */
};

Expand All @@ -3188,7 +3209,7 @@ PyTypeObject PyZip_Type = {
sizeof(zipobject), /* tp_basicsize */
0, /* tp_itemsize */
/* methods */
(destructor)zip_dealloc, /* tp_dealloc */
zip_dealloc, /* tp_dealloc */
0, /* tp_vectorcall_offset */
0, /* tp_getattr */
0, /* tp_setattr */
Expand All @@ -3206,12 +3227,12 @@ PyTypeObject PyZip_Type = {
Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
Py_TPFLAGS_BASETYPE, /* tp_flags */
zip_doc, /* tp_doc */
(traverseproc)zip_traverse, /* tp_traverse */
zip_traverse, /* tp_traverse */
0, /* tp_clear */
0, /* tp_richcompare */
0, /* tp_weaklistoffset */
PyObject_SelfIter, /* tp_iter */
(iternextfunc)zip_next, /* tp_iternext */
zip_next, /* tp_iternext */
zip_methods, /* tp_methods */
0, /* tp_members */
0, /* tp_getset */
Expand Down

0 comments on commit 28ffdc5

Please sign in to comment.