Skip to content

gh-148390: fix undefined behavior of memoryview(...).cast("?")#148454

Merged
picnixz merged 8 commits intopython:mainfrom
picnixz:fix/ubsan/memoryview-148390
Apr 15, 2026
Merged

gh-148390: fix undefined behavior of memoryview(...).cast("?")#148454
picnixz merged 8 commits intopython:mainfrom
picnixz:fix/ubsan/memoryview-148390

Conversation

@picnixz
Copy link
Copy Markdown
Member

@picnixz picnixz commented Apr 12, 2026

Copy link
Copy Markdown
Member

@StanFromIreland StanFromIreland left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the UB is fixed, please remove it from the suppressions list:

# Objects/memoryobject.c:3032:15: runtime error: load of value 2, which is not a valid value for type 'bool'
bool:Objects/memoryobject.c

Copy link
Copy Markdown
Member

@skirpichev skirpichev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good.

Though, maybe move macro closer to unpack_single() definition?

@picnixz
Copy link
Copy Markdown
Member Author

picnixz commented Apr 13, 2026

Though, maybe move macro closer to unpack_single() definition?

The problem is that it's being used in two places so... I preferred moving it where we had "helpers".

Copy link
Copy Markdown
Member

@vstinner vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I confirm that without the fix, the test fails and logs an UBSan error:

test_compare_equal (test.test_memoryview.ArrayMemoryviewTest.test_compare_equal) ...
Objects/memoryobject.c:3032:15: runtime error: load of value 2, which is not a valid value for type '_Bool'
Objects/memoryobject.c:3032:15: runtime error: load of value 2, which is not a valid value for type '_Bool'
Objects/memoryobject.c:1814:15: runtime error: load of value 2, which is not a valid value for type '_Bool'
FAIL

======================================================================
FAIL: test_compare_equal (test.test_memoryview.ArrayMemoryviewTest.test_compare_equal)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/vstinner/python/main/Lib/test/test_memoryview.py", line 628, in test_compare_equal
    self.assertEqual(m1a.tolist(), [False, True, False])
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError: Lists differ: [False, False, False] != [False, True, False]

First differing element 1:
False
True

- [False, False, False]
?         ^^^^

+ [False, True, False]
?         ^^^

I tested Python built with:
./configure --with-pydebug --with-undefined-behavior-sanitizer && make clean

Copy link
Copy Markdown
Member

@serhiy-storchaka serhiy-storchaka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. 👍

@picnixz
Copy link
Copy Markdown
Member Author

picnixz commented Apr 14, 2026

@serhiy-storchaka I addressed the comments, so you can look at the last 3 commits if you want to see the update

@picnixz picnixz requested review from colesbury and vstinner April 14, 2026 18:03
@picnixz
Copy link
Copy Markdown
Member Author

picnixz commented Apr 14, 2026

Btw, what's the policy with static const at a module level? should we totally avoid it? is it ok? or is preferrable to use local function storage? (I moved it in the module to avoid repeating the macro)

@serhiy-storchaka
Copy link
Copy Markdown
Member

I think it is only issue if its value can conflict between subinterpreters, or if references to it can outlive the dynamically loaded extension., or (in C++) when the constructor is executed at runtime and race conditions are possible. This is not a such case.

@encukou
Copy link
Copy Markdown
Member

encukou commented Apr 15, 2026

Btw, what's the policy with static const at a module level?

Totally fine for immutable data like bool_false.

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Copy link
Copy Markdown
Member

@vstinner vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@picnixz picnixz enabled auto-merge (squash) April 15, 2026 11:30
@picnixz picnixz merged commit 69e0a78 into python:main Apr 15, 2026
54 checks passed
@picnixz picnixz added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 15, 2026
@miss-islington-app
Copy link
Copy Markdown

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

@miss-islington-app
Copy link
Copy Markdown

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

@picnixz picnixz deleted the fix/ubsan/memoryview-148390 branch April 15, 2026 12:07
@miss-islington-app
Copy link
Copy Markdown

Sorry, @picnixz, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 69e0a78e6edc3166c7a5b166955c0cefd1bacd5d 3.13

@miss-islington-app
Copy link
Copy Markdown

Sorry, @picnixz, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 69e0a78e6edc3166c7a5b166955c0cefd1bacd5d 3.14

@picnixz
Copy link
Copy Markdown
Member Author

picnixz commented Apr 15, 2026

Huh. Ok. Well.. I am not really available to make the backports and will be leaving tomorrow for a week sooo.... if someone wants to do the backports they can (otherwise I'll do it when I'm back)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants