gh-136660: fix UB in dictobject memcpy when there are 0 entries#136662
gh-136660: fix UB in dictobject memcpy when there are 0 entries#136662marler8997 wants to merge 1 commit intopython:mainfrom marler8997:fixDictobjUb
Conversation
|
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
Objects/dictobject.c
Outdated
| if (oldkeys->dk_nentries == numentries && mp->ma_keys->dk_kind == DICT_KEYS_UNICODE) { | ||
| memcpy(newentries, oldentries, numentries * sizeof(PyDictUnicodeEntry)); | ||
| // avoid memcpy on 0 entries to avoid UB on oldentries | ||
| if (numentries > 0) memcpy(newentries, oldentries, numentries * sizeof(PyDictUnicodeEntry)); |
There was a problem hiding this comment.
Please conform to PEP 7, our C code style guide.
There was a problem hiding this comment.
updated, apologies for missing this
|
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
|
This is already fixed. |
|
IIUC this is about |
|
See #136660 Is 0-byte memcpy undefined behavior? |
|
This one was also a misaligned read. The other way to solve this problem would have been to ensure So, it looks like the same issue, I was just building version |
No it's a well-defined behavior. At least according to C99 §7.21.1/2:
This (my) fix was not really correct as it simply suppresses the compiler warning (also, I'm not sure about the |
My understanding is this UB was a combination of the unaligned address and memcpy. If you pass an unaligned address to a function and it's never used, it's well-defined, however, if you pass it to memcpy it becomes undefined behavior, even if the size is 0. memcpy is "special". Since |
https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html#issue-suppression |
|
AFAIR, casting to
EDIT: though in this case it says "object type", a EDIT 2: Note that the pointers compare equal but are not necessarily the same (alignment may have changed) |
Uh oh!
There was an error while loading. Please reload this page.