Skip to content

Failed assertion in typeobject.c::wrap_buffer for b"".__buffer__(-2**31 - 1) #126594

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
devdanzin opened this issue Nov 8, 2024 · 2 comments
Closed

Failed assertion in typeobject.c::wrap_buffer for b"".__buffer__(-2**31 - 1) #126594

devdanzin opened this issue Nov 8, 2024 · 2 comments
Assignees
@JelleZijlstra
Labels
3.12 only security fixes 3.13 bugs and security fixes 3.14 bugs and security fixes interpreter-core (Objects, Python, Grammar, and Parser dirs) type-crash A hard crash of the interpreter, possibly with a core dump

Comments

@devdanzin
Copy link
Contributor

devdanzin commented Nov 8, 2024 •
edited by bedevere-app bot
Loading

Crash report

What happened?

Calling bytes_object.__buffer__(large_negative_number) in a debug build aborts with this message:

>>> b"".__buffer__(-2**31 - 1)
python: Objects/typeobject.c:9321: wrap_buffer: Assertion `_Py_STATIC_CAST(Py_ssize_t, _Py_STATIC_CAST(int, (flags))) == (flags)' failed.
Aborted

Found using fusil by @vstinner.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux, Windows

Output from running 'python -VV' on the command line:

Python 3.14.0a1+ (heads/main:4ea214ea982, Nov 6 2024, 00:52:15) [MSC v.1941 64 bit (AMD64)]

Linked PRs
@devdanzin devdanzin added the type-crash A hard crash of the interpreter, possibly with a core dump label Nov 8, 2024
@JelleZijlstra JelleZijlstra self-assigned this Nov 8, 2024
@picnixz picnixz added the interpreter-core (Objects, Python, Grammar, and Parser dirs) label Nov 8, 2024
vstinner added a commit to vstinner/cpython that referenced this issue Nov 12, 2024
@vstinner
pythongh-126594: Fix typeobject.c wrap_buffer() cast
019df14 
Reject flags smaller than INT_MIN.
@bedevere-app bedevere-app bot mentioned this issue Nov 12, 2024
Merged
@vstinner
Copy link
Member

I wrote PR gh-126754 to fix the issue.

@picnixz picnixz added 3.12 only security fixes 3.13 bugs and security fixes 3.14 bugs and security fixes labels Nov 15, 2024
vstinner added a commit that referenced this issue Nov 19, 2024
@vstinner @JelleZijlstra
gh-126594: Fix typeobject.c wrap_buffer() cast (#126754)
84f07c3 
Reject flags smaller than INT_MIN.

Co-authored-by: Jelle Zijlstra <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Nov 19, 2024
@vstinner @JelleZijlstra @miss-islington
pythongh-126594: Fix typeobject.c wrap_buffer() cast (pythonGH-126754)
d97fc20 
Reject flags smaller than INT_MIN.

(cherry picked from commit 84f07c3)

Co-authored-by: Victor Stinner <[email protected]>
Co-authored-by: Jelle Zijlstra <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Nov 19, 2024
@vstinner @JelleZijlstra @miss-islington
pythongh-126594: Fix typeobject.c wrap_buffer() cast (pythonGH-126754)
49c4698 
Reject flags smaller than INT_MIN.

(cherry picked from commit 84f07c3)

Co-authored-by: Victor Stinner <[email protected]>
Co-authored-by: Jelle Zijlstra <[email protected]>
This was referenced Nov 19, 2024
Merged
Merged
vstinner added a commit that referenced this issue Nov 19, 2024
@miss-islington @vstinner @JelleZijlstra
[3.12] gh-126594: Fix typeobject.c wrap_buffer() cast (GH-126754) (#1…
9345dc1 
…27005)

gh-126594: Fix typeobject.c wrap_buffer() cast (GH-126754)

Reject flags smaller than INT_MIN.

(cherry picked from commit 84f07c3)

Co-authored-by: Victor Stinner <[email protected]>
Co-authored-by: Jelle Zijlstra <[email protected]>
vstinner added a commit that referenced this issue Nov 19, 2024
@miss-islington @vstinner @JelleZijlstra
[3.13] gh-126594: Fix typeobject.c wrap_buffer() cast (GH-126754) (#1…
fd276ad 
…27004)

gh-126594: Fix typeobject.c wrap_buffer() cast (GH-126754)

Reject flags smaller than INT_MIN.

(cherry picked from commit 84f07c3)

Co-authored-by: Victor Stinner <[email protected]>
Co-authored-by: Jelle Zijlstra <[email protected]>
@devdanzin
Copy link
Contributor Author

Closing since the PRs have been merged, please reopen if there's anything left to do.

@github-actions github-actions bot mentioned this issue Dec 1, 2024
Closed
ebonnal pushed a commit to ebonnal/cpython that referenced this issue Jan 12, 2025
@vstinner @JelleZijlstra @ebonnal
pythongh-126594: Fix typeobject.c wrap_buffer() cast (python#126754)
032c25a 
Reject flags smaller than INT_MIN.

Co-authored-by: Jelle Zijlstra <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@JelleZijlstra JelleZijlstra

Labels
3.12 only security fixes 3.13 bugs and security fixes 3.14 bugs and security fixes interpreter-core (Objects, Python, Grammar, and Parser dirs) type-crash A hard crash of the interpreter, possibly with a core dump
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@vstinner @JelleZijlstra @picnixz @devdanzin