GeezerVison

crates/capi/src/abstract_.rs (1)

91-101: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Missing keyword argument value count in args_len calculation causes out-of-bounds read.

The args_len at line 91 extracts only the positional argument count (nargsf & !PY_VECTORCALL_ARGUMENTS_OFFSET), but per the vectorcall protocol, the raw args array contains both positional arguments and keyword argument values in sequence: [receiver, pos_arg_1, ..., pos_arg_N, kwarg_val_1, ..., kwarg_val_M].

Creating the slice with only the positional count omits the keyword argument values. When the slice pointer is passed to PyObject_Vectorcall along with the original kwnames, that function attempts to read keyword argument values beyond the slice boundary, causing undefined behavior.

The fix is to compute args_len to include both positional and keyword argument value counts, mirroring the calculation in PyObject_Vectorcall at line 68.

Proposed fix: include kwarg values in args_len

-        let args_len = nargsf & !PY_VECTORCALL_ARGUMENTS_OFFSET;
+        let num_positional_args = nargsf & !PY_VECTORCALL_ARGUMENTS_OFFSET;
+
+        let kwnames_len = unsafe {
+            kwnames
+                .as_ref()
+                .map(|tuple| tuple.try_downcast_ref::<PyTuple>(vm).map(|t| t.len()))
+                .transpose()?
+                .unwrap_or(0)
+        };
+
+        let args_len = num_positional_args + kwnames_len;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/capi/src/abstract_.rs` around lines 91 - 101, The slice length
calculation for args_len wrongly uses only positional count (nargsf &
!PY_VECTORCALL_ARGUMENTS_OFFSET), which omits keyword argument values and can
cause out-of-bounds reads when PyObject_Vectorcall expects them; update the
args_len computation to add the keyword value count when kwnames is non-null
(mirror the same calculation used by PyObject_Vectorcall), i.e. derive the
keyword count from nargsf (using PY_VECTORCALL_ARGUMENTS_OFFSET mask) and
include it in args_len before creating the slice for receiver/args so the full
[receiver, pos..., kw_vals...] region is covered.