-
-
Notifications
You must be signed in to change notification settings - Fork 33.2k
Closed
Labels
topic-ctypestopic-free-threadingtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
Description
Bug report
Bug description:
As @kumaraditya303 mentioned, ctypes.Pointer.get_contents
has a thread safety bug that I missed when I originally fixed it.
cpython/Modules/_ctypes/_ctypes.c
Lines 5413 to 5430 in 3b3720f
Pointer_get_contents(PyObject *self, void *closure) | |
{ | |
void *deref = locked_deref(_CDataObject_CAST(self)); | |
if (deref == NULL) { | |
PyErr_SetString(PyExc_ValueError, | |
"NULL pointer access"); | |
return NULL; | |
} | |
ctypes_state *st = get_module_state_by_def(Py_TYPE(Py_TYPE(self))); | |
StgInfo *stginfo; | |
if (PyStgInfo_FromObject(st, self, &stginfo) < 0) { | |
return NULL; | |
} | |
assert(stginfo); /* Cannot be NULL for pointer instances */ | |
return PyCData_FromBaseObj(st, stginfo->proto, self, 0, deref); | |
} |
Dereferencing the pointer is locked, but it's unsafe to call PyCData_FromBaseObj
without holding the lock, because the pointer might be invalidated concurrently. I suspect this kind of bug exists with other uses of locked_deref
too.
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Linked PRs
Metadata
Metadata
Assignees
Labels
topic-ctypestopic-free-threadingtype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error