GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-111178: Avoid calling functions from incompatible pointer types in listobject.c by chrstphrchvz · Pull Request #112820 · python/cpython

Conversation

chrstphrchvz commented Dec 7, 2023 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Issue: UBSan: Calling a function through pointer to incorrect function type is undefined behavior #111178

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

chrstphrchvz added 26 commits

December 6, 2023 19:42


          Update listobject.c

31f6b8f

Objects/listobject.c:3167:5: warning: cast from 'PyObject *(*)(PyListObject *)' (aka 'struct _object *(*)(PyListObject *)') to 'reprfunc' (aka 'struct _object *(*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict]
 3167 |     (reprfunc)list_repr,                        /* tp_repr */
      |     ^~~~~~~~~~~~~~~~~~~

Example UBSan -fsanitize=function error:

Objects/object.c:674:11: runtime error: call to function list_repr through pointer to incorrect function type 'struct _object *(*)(struct _object *)'
listobject.c:382: note: list_repr defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/object.c:674:11 in


          Update listobject.c

0bfd8d4

Objects/listobject.c:3162:5: warning: cast from 'void (*)(PyListObject *)' to 'destructor' (aka 'void (*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict]
 3162 |     (destructor)list_dealloc,                   /* tp_dealloc */
      |     ^~~~~~~~~~~~~~~~~~~~~~~~

Example UBSan error:

Objects/object.c:2857:5: runtime error: call to function list_dealloc through pointer to incorrect function type 'void (*)(struct _object *)'
listobject.c:347: note: list_dealloc defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/object.c:2857:5 in


          Update listobject.c

3514d30

Objects/listobject.c:3181:5: warning: cast from 'int (*)(PyListObject *, visitproc, void *)' (aka 'int (*)(PyListObject *, int (*)(struct _object *, void *), void *)') to 'traverseproc' (aka 'int (*)(struct _object *, int (*)(struct _object *, void *), void *)') converts to incompatible function type [-Wcast-function-type-strict]
 3181 |     (traverseproc)list_traverse,                /* tp_traverse */
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~

Example UBSan error:

Modules/gcmodule.c:493:16: runtime error: call to function list_traverse through pointer to incorrect function type 'int (*)(struct _object *, int (*)(struct _object *, void *), void *)'
listobject.c:2760: note: list_traverse defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Modules/gcmodule.c:493:16 in


          Update listobject.c

166c6c6

Objects/listobject.c:3182:5: warning: cast from 'int (*)(PyListObject *)' to 'inquiry' (aka 'int (*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict]
 3182 |     (inquiry)list_clear_slot,                   /* tp_clear */
      |     ^~~~~~~~~~~~~~~~~~~~~~~~

Example UBSan error:

Modules/gcmodule.c:1033:24: runtime error: call to function list_clear_slot through pointer to incorrect function type 'int (*)(struct _object *)'
listobject.c:620: note: list_clear_slot defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Modules/gcmodule.c:1033:24 in


          Update listobject.c

Objects/listobject.c:2928:5: warning: cast from 'int (*)(PyListObject *, Py_ssize_t, PyObject *)' (aka 'int (*)(PyListObject *, long, struct _object *)') to 'ssizeobjargproc' (aka 'int (*)(struct _object *, long, struct _object *)') converts to incompatible function type [-Wcast-function-type-strict]
 2928 |     (ssizeobjargproc)list_ass_item,             /* sq_ass_item */
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Example UBSan error:

Objects/abstract.c:2032:19: runtime error: call to function list_ass_item through pointer to incorrect function type 'int (*)(struct _object *, long, struct _object *)'
listobject.c:780: note: list_ass_item defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/abstract.c:2032:19 in


          Update listobject.c

08423ce

Objects/listobject.c:3251:5: warning: cast from 'PyObject *(*)(_PyListIterObject *)' (aka 'struct _object *(*)(_PyListIterObject *)') to 'iternextfunc' (aka 'struct _object *(*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict]
 3251 |     (iternextfunc)listiter_next,                /* tp_iternext */
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~

Example UBSan error:

Objects/typeobject.c:8150:11: runtime error: call to function listiter_next through pointer to incorrect function type 'struct _object *(*)(struct _object *)'
listobject.c:3292: note: listiter_next defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/typeobject.c:8150:11 in


          Update listobject.c

e5c70b4

Objects/listobject.c:2923:5: warning: cast from 'Py_ssize_t (*)(PyListObject *)' (aka 'long (*)(PyListObject *)') to 'lenfunc' (aka 'long (*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict]
 2923 |     (lenfunc)list_length,                       /* sq_length */
      |     ^~~~~~~~~~~~~~~~~~~~
Objects/listobject.c:3152:5: warning: cast from 'Py_ssize_t (*)(PyListObject *)' (aka 'long (*)(PyListObject *)') to 'lenfunc' (aka 'long (*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict]
 3152 |     (lenfunc)list_length,
      |     ^~~~~~~~~~~~~~~~~~~~

Example UBSan error:

Objects/object.c:1820:15: runtime error: call to function list_length through pointer to incorrect function type 'long (*)(struct _object *)'
listobject.c:438: note: list_length defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/object.c:1820:15 in


          Update listobject.c

3f32102

Objects/listobject.c:3229:5: warning: cast from 'void (*)(_PyListIterObject *)' to 'destructor' (aka 'void (*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict]
 3229 |     (destructor)listiter_dealloc,               /* tp_dealloc */
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~

Example UBSan error:

Python/generated_cases.c.h:3322:21: runtime error: call to function listiter_dealloc through pointer to incorrect function type 'void (*)(struct _object *)'
listobject.c:3222: note: listiter_dealloc defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Python/generated_cases.c.h:3322:21 in


          Update listobject.c

136415b

Objects/listobject.c:2924:5: warning: cast from 'PyObject *(*)(PyListObject *, PyObject *)' (aka 'struct _object *(*)(PyListObject *, struct _object *)') to 'binaryfunc' (aka 'struct _object *(*)(struct _object *, struct _object *)') converts to incompatible function type [-Wcast-function-type-strict]
 2924 |     (binaryfunc)list_concat,                    /* sq_concat */
      |     ^~~~~~~~~~~~~~~~~~~~~~~
Objects/listobject.c:2925:5: warning: cast from 'PyObject *(*)(PyListObject *, Py_ssize_t)' (aka 'struct _object *(*)(PyListObject *, long)') to 'ssizeargfunc' (aka 'struct _object *(*)(struct _object *, long)') converts to incompatible function type [-Wcast-function-type-strict]
 2925 |     (ssizeargfunc)list_repeat,                  /* sq_repeat */
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~
Objects/listobject.c:2926:5: warning: cast from 'PyObject *(*)(PyListObject *, Py_ssize_t)' (aka 'struct _object *(*)(PyListObject *, long)') to 'ssizeargfunc' (aka 'struct _object *(*)(struct _object *, long)') converts to incompatible function type [-Wcast-function-type-strict]
 2926 |     (ssizeargfunc)list_item,                    /* sq_item */
      |     ^~~~~~~~~~~~~~~~~~~~~~~

Example UBSan errors:

Objects/abstract.c:1137:18: runtime error: call to function list_concat through pointer to incorrect function type 'struct _object *(*)(struct _object *, struct _object *)'
listobject.c:518: note: list_concat defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/abstract.c:1137:18 in
Objects/abstract.c:1159:21: runtime error: call to function list_repeat through pointer to incorrect function type 'struct _object *(*)(struct _object *, long)'
listobject.c:558: note: list_repeat defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/abstract.c:1159:21 in
Objects/abstract.c:1946:25: runtime error: call to function list_item through pointer to incorrect function type 'struct _object *(*)(struct _object *, long)'
listobject.c:462: note: list_item defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/abstract.c:1946:25 in


          Make list_subscript() compatible with PyCFunction and binaryfunc

7fc9eaf


          Make listreviter_traverse() compatible with traverseproc

5dbaa7e


          Make listreviter_dealloc() compatible with destructor

825867b


          Make listreviter_next() compatible with iternextfunc

77927e5


          Make listiter_traverse() compatible with traverseproc

6dd4236


          Make listreviter_len() compatible with PyCFunction

8b6babf


          Make listreviter_reduce() compatible with PyCFunction

e20d180


          Make listreviter_setstate() compatible with PyCFunction

aceb958


          Make list_contains() compatible with objobjproc


          Make list_inplace_concat() compatible with binaryfunc

7ef5480


          Make list_ass_subscript() compatible with objobjargproc

6445fc6


          Make listiter_len() compatible with PyCFunction

fc9fccb


          Make listiter_reduce() compatible with PyCFunction

2dd6685


          Make listiter_setstate() compatible with PyCFunction

bf28e3e


          Fix warning in list_subscript()

15f1bfc

Objects/listobject.c:2956:26: warning: incompatible pointer types passing 'PyListObject *' to parameter of type 'PyObject *' (aka 'struct _object *') [-Wincompatible-pointer-types]
 2956 |         return list_item(self, i);
      |                          ^~~~


          Make list_inplace_repeat() compatible with ssizeargfunc

720c908


          Slightly less inconsistent parameter names

d2bea5b

bedevere-app Bot added the awaiting review label

Dec 7, 2023

bedevere-app Bot mentioned this pull request

Dec 7, 2023

UBSan: Calling a function through pointer to incorrect function type is undefined behavior #111178

Closed

Eclips4 requested review from encukou and vstinner

December 7, 2023 11:23

encukou added the skip news label

Dec 11, 2023

encukou approved these changes

Jan 2, 2024

View reviewed changes

encukou left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not a fan of the aa name. For the future PRs, I propose using _self for “self argument of the wrong type, only to be used once in a cast”.
But let's not make that block this PR; aa does match the existing names here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

chrstphrchvz reacted with thumbs up emoji

All reactions

👍 1 reaction

bedevere-app Bot added awaiting merge and removed awaiting review labels

Jan 2, 2024

encukou merged commit 5d36a95 into python:main

Jan 2, 2024

bedevere-app Bot removed the awaiting merge label

Jan 2, 2024

chrstphrchvz deleted the patch-111178-listobject branch

January 2, 2024 14:23

kulikjak pushed a commit to kulikjak/cpython that referenced this pull request

Jan 22, 2024


          pythongh-111178: Avoid calling functions from incompatible pointer ty…

1de0ffd

…pes in listobject.c (pythonGH-112820)

Fix undefined behavior warnings (UBSan  -fsanitize=function), for example:

Objects/object.c:674:11: runtime error: call to function list_repr through pointer to incorrect function type 'struct _object *(*)(struct _object *)'
listobject.c:382: note: list_repr defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/object.c:674:11 in

aisk pushed a commit to aisk/cpython that referenced this pull request

Feb 11, 2024


          pythongh-111178: Avoid calling functions from incompatible pointer ty…

21a10c5

…pes in listobject.c (pythonGH-112820)

Fix undefined behavior warnings (UBSan  -fsanitize=function), for example:

Objects/object.c:674:11: runtime error: call to function list_repr through pointer to incorrect function type 'struct _object *(*)(struct _object *)'
listobject.c:382: note: list_repr defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/object.c:674:11 in

Glyphack pushed a commit to Glyphack/cpython that referenced this pull request

Sep 2, 2024


          pythongh-111178: Avoid calling functions from incompatible pointer ty…

316bad8

…pes in listobject.c (pythonGH-112820)

Fix undefined behavior warnings (UBSan  -fsanitize=function), for example:

Objects/object.c:674:11: runtime error: call to function list_repr through pointer to incorrect function type 'struct _object *(*)(struct _object *)'
listobject.c:382: note: list_repr defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/object.c:674:11 in

Reviewers

encukou

encukou approved these changes

vstinner

Awaiting requested review from vstinner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

skip news

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

chrstphrchvz commented Dec 7, 2023 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

encukou left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chrstphrchvz commented Dec 7, 2023 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.