Fix segfault in Record.get() with invalid positional argument count#1333
Open
apoorvdarshan wants to merge 1 commit into
Open
Fix segfault in Record.get() with invalid positional argument count#1333apoorvdarshan wants to merge 1 commit into
apoorvdarshan wants to merge 1 commit into
Conversation
record_get() set a TypeError with PyErr_Format() when given the wrong number of positional arguments but did not return, falling through to record_item_by_name() with an uninitialized `key` pointer. Depending on the stack contents this either crashed the interpreter (SEGV) or silently returned the default instead of raising TypeError. The release build also emitted a `'key' may be used uninitialized` warning. Return NULL immediately after setting the error, and add regression coverage for the invalid argument-count cases. Fixes MagicStack#1328.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
asyncpg.Record.get()could crash the interpreter (SEGV) — or, depending on stack contents, silently return the default instead of raisingTypeError— when called with an invalid number of positional arguments, e.g.r.get()orr.get("a", 2, 3).In
record_get()(asyncpg/protocol/record/recordobj.c), the wrong-argument-countelsebranch sets aTypeErrorviaPyErr_Format()but does not return. Execution falls through to:with
keyleft uninitialized, which is undefined behavior — a native crash on release builds. The release build also emittedwarning: 'key' may be used uninitialized [-Wmaybe-uninitialized].Fix
Return
NULLimmediately after setting the argument-count error:Tests / Verification
TestRecord::test_record_get_invalid_argsintests/test_record.pyassertingTypeErrorforr.get(),r.get("a", 2, 3), andr.get(default=2).master(AssertionError: TypeError not raised) and passes after the fix.python setup.py build_ext --inplace) and ran the fulltests/test_record.pymodule: 26 passed. The rebuild no longer emits the'key' may be used uninitializedwarning.r.get("a"),r.get("a", default)) are unchanged.Fixes #1328.
Disclosure: prepared with AI assistance; reviewed and verified locally.