Merge pull request #346 from PyO3/release-0.17

merge 0.17 fixes into main

Author: davidhewitt

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: stable
@@ -48,7 +48,7 @@ jobs:
           - python-version: pypy-3.8
             platform: { os: "ubuntu-latest", python-architecture: "x64", rust-target: "x86_64-unknown-linux-gnu" }
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v2
         with:
@@ -90,17 +90,37 @@ jobs:
     runs-on: ubuntu-latest
     needs: [lint, check-msrv, examples]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: messense/maturin-action@v1
         with:
           target: aarch64
           manylinux: auto
           args: --manifest-path examples/simple/Cargo.toml
 
+  address-sanitizer:
+    runs-on: ubuntu-22.04
+    needs: [lint, check-msrv, examples]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions-rs/toolchain@v1
+        with:
+          toolchain: nightly
+          profile: minimal
+          components: rust-src
+          default: true
+      - uses: Swatinem/rust-cache@v2
+        continue-on-error: true
+      - run: |
+            pip install numpy
+            cargo test -Zbuild-std --target x86_64-unknown-linux-gnu --release --lib --tests
+        env:
+          RUSTFLAGS: -Zsanitizer=address
+          ASAN_OPTIONS: detect_leaks=0
+
   check-msrv:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up Python
         uses: actions/setup-python@v2
         with:
@@ -152,7 +172,7 @@ jobs:
   examples:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up Python
         uses: actions/setup-python@v2
         with:
@@ -177,7 +197,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [lint, check-msrv, examples]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Set up Python
         uses: actions/setup-python@v2
         with:

CHANGELOG.md

@@ -3,6 +3,10 @@
 - Unreleased
   - Drop our wrapper for NumPy iterators which were deprecated in v0.16.0 as ndarray's iteration facilities are almost always preferable. ([#324](https://github.com/PyO3/rust-numpy/pull/324))
 
+- v0.17.1
+  - Fix use-after-free in `PyArray::resize`, `PyArray::reshape` and `PyArray::reshape_with_order`. ([#341](https://github.com/PyO3/rust-numpy/pull/341))
+  - Fix UB in `ToNpyDims::as_dims_ptr` with dimensions of dynamic size (-1). ([#344](https://github.com/PyO3/rust-numpy/pull/344))
+
 - v0.17.0
   - Add dynamic borrow checking to safely construct references into the interior of NumPy arrays. ([#274](https://github.com/PyO3/rust-numpy/pull/274))
     - The deprecated iterator builders `NpySingleIterBuilder::{readonly,readwrite}` and `NpyMultiIterBuilder::add_{readonly,readwrite}` now take referencces to `PyReadonlyArray` and `PyReadwriteArray` instead of consuming them.

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "numpy"
-version = "0.17.0"
+version = "0.17.1"
 authors = [
     "The rust-numpy Project Developers",
     "PyO3 Project and Contributors <https://github.com/PyO3>"

src/array.rs

@@ -464,7 +464,7 @@ impl<T: Element, D: Dimension> PyArray<T, D> {
     where
         ID: IntoDimension<Dim = D>,
     {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         let ptr = PY_ARRAY_API.PyArray_NewFromDescr(
             py,
             PY_ARRAY_API.get_type_object(py, npyffi::NpyTypes::PyArray_Type),
@@ -490,7 +490,7 @@ impl<T: Element, D: Dimension> PyArray<T, D> {
     where
         ID: IntoDimension<Dim = D>,
     {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         let ptr = PY_ARRAY_API.PyArray_NewFromDescr(
             py,
             PY_ARRAY_API.get_type_object(py, npyffi::NpyTypes::PyArray_Type),
@@ -612,7 +612,7 @@ impl<T: Element, D: Dimension> PyArray<T, D> {
     where
         ID: IntoDimension<Dim = D>,
     {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         unsafe {
             let ptr = PY_ARRAY_API.PyArray_Zeros(
                 py,
@@ -1379,7 +1379,8 @@ impl<T: Element, D> PyArray<T, D> {
         dims: ID,
         order: NPY_ORDER,
     ) -> PyResult<&'py PyArray<T, ID::Dim>> {
-        let mut dims = dims.into_dimension().to_npy_dims();
+        let mut dims = dims.into_dimension();
+        let mut dims = dims.to_npy_dims();
         let ptr = unsafe {
             PY_ARRAY_API.PyArray_Newshape(
                 self.py(),
@@ -1436,7 +1437,8 @@ impl<T: Element, D> PyArray<T, D> {
     /// [ndarray-resize]: https://numpy.org/doc/stable/reference/generated/numpy.ndarray.resize.html
     /// [PyArray_Resize]: https://numpy.org/doc/stable/reference/c-api/array.html#c.PyArray_Resize
     pub unsafe fn resize<ID: IntoDimension>(&self, dims: ID) -> PyResult<()> {
-        let mut dims = dims.into_dimension().to_npy_dims();
+        let mut dims = dims.into_dimension();
+        let mut dims = dims.to_npy_dims();
         let res = PY_ARRAY_API.PyArray_Resize(
             self.py(),
             self.as_array_ptr(),

src/convert.rs

@@ -213,11 +213,11 @@ pub trait ToNpyDims: Dimension + Sealed {
         self.ndim() as c_int
     }
     #[doc(hidden)]
-    fn as_dims_ptr(&self) -> *mut npyffi::npy_intp {
-        self.slice().as_ptr() as *mut npyffi::npy_intp
+    fn as_dims_ptr(&mut self) -> *mut npyffi::npy_intp {
+        self.slice_mut().as_ptr() as *mut npyffi::npy_intp
     }
     #[doc(hidden)]
-    fn to_npy_dims(&self) -> npyffi::PyArray_Dims {
+    fn to_npy_dims(&mut self) -> npyffi::PyArray_Dims {
         npyffi::PyArray_Dims {
             ptr: self.as_dims_ptr(),
             len: self.ndim_cint(),

tests/array.rs

@@ -4,8 +4,8 @@ use std::mem::size_of;
 use half::f16;
 use ndarray::{array, s, Array1, Dim};
 use numpy::{
-    dtype, get_array_module, pyarray, PyArray, PyArray1, PyArray2, PyArrayDescr, PyArrayDyn,
-    ToPyArray,
+    dtype, get_array_module, npyffi::NPY_ORDER, pyarray, PyArray, PyArray1, PyArray2, PyArrayDescr,
+    PyArrayDyn, ToPyArray,
 };
 use pyo3::{
     py_run, pyclass, pymethods,
@@ -508,6 +508,23 @@ fn get_works() {
     });
 }
 
+#[test]
+fn reshape() {
+    Python::with_gil(|py| {
+        let array = PyArray::from_iter(py, 0..9)
+            .reshape_with_order([3, 3], NPY_ORDER::NPY_FORTRANORDER)
+            .unwrap();
+
+        assert_eq!(
+            array.readonly().as_array(),
+            array![[0, 3, 6], [1, 4, 7], [2, 5, 8]]
+        );
+        assert!(array.is_fortran_contiguous());
+
+        assert!(array.reshape([5]).is_err());
+    });
+}
+
 #[cfg(feature = "half")]
 #[test]
 fn half_works() {