GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-160708: Use the type size for resized ctypes simple objects by iamsaugatpandey · Pull Request #160720 · python/cpython

Conversation

@iamsaugatpandey

@iamsaugatpandey iamsaugatpandey commented Oct 26, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

After ctypes.resize(), the buffer of a simple ctypes object is bigger than the type itself. Two places still used the buffer size (b_size) where they needed the type size:

  • Simple_bool_impl() compared b_size bytes against a 16-byte zero string literal. For a resized object it reads past the literal, and it can also return the wrong answer (bool(c_int(0)) is True if the extra space isn't zero).
  • PyCSimpleType_paramfunc() copied b_size bytes into PyCArgObject.value, which is a fixed-size union, so passing a resized object to a foreign function overwrote the heap.

Both now use info->size, the same as the value getter since gh-159739. bool() checks the value's bytes in a loop instead of comparing with the literal. This also covers simple types larger than 16 bytes, such as c_longdouble_complex on x86-64.

Tests: bool() on a resized c_int whose extra space is non-zero, a call to tf_i with a resized c_int, and bool() on the complex types.

  • Issue: ctypes: out-of-bounds read/write in bool() and argument passing after resize() #160708

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@iamsaugatpandey
pythongh-160708: Use the type size for resized ctypes simple objects
6b7acc0 
After ctypes.resize(), a simple object's buffer is larger than its
type. bool() and passing the object to a foreign function still used
the buffer size, so bool() read past a 16-byte string literal and the
call copied the whole buffer into the fixed-size PyCArgObject value,
corrupting the heap.

Use the type's size instead, like the value getter does since
pythongh-159739. bool() now checks the value's bytes directly, which also
covers simple types larger than 16 bytes such as c_longdouble_complex
on x86-64.
Copilot AI balanced review requested due to automatic review settings October 26, 2026 16:24
@bedevere-app bedevere-app Bot added the awaiting review label Oct 26, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Oct 26, 2026
ctypes: out-of-bounds read/write in bool() and argument passing after resize() #160708
Closed
Copilot AI reviewed Oct 26, 2026

Copilot AI left a comment

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@iamsaugatpandey

iamsaugatpandey commented Nov 3, 2026

Copy link
Copy Markdown
Contributor Author

Hi @JelleZijlstra, since you reviewed gh-159739 (#159767, reading resized ctypes scalars using their declared size): this PR is the follow-up for the two places that still use b_size after ctypes.resize(). Those are bool(), which reads past a 16-byte literal, and passing the object to a foreign function, which overflows PyCArgObject.value and corrupts the heap. Both now use info->size, like the value getter. CI is green. Would you have time to take a look? cc @ZeroIntensity
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
ZeroIntensity
ZeroIntensity approved these changes Nov 4, 2026
View reviewed changes
Comment thread Modules/_ctypes/_ctypes.c Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Modules/_ctypes/_ctypes.c Resolved

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Nov 4, 2026
@ZeroIntensity ZeroIntensity added needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Nov 4, 2026
@ZeroIntensity
Apply batched suggestions from code review
ac78029 
Co-authored-by: Peter Bierma <[email protected]>
@ZeroIntensity
ZeroIntensity enabled auto-merge (squash) November 4, 2026 13:43
@ZeroIntensity
ZeroIntensity merged commit 44579b0 into python:main Nov 4, 2026
56 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Nov 4, 2026
@miss-islington-app

miss-islington-app Bot commented Nov 4, 2026

Copy link
Copy Markdown

Thanks @iamsaugatpandey for the PR, and @ZeroIntensity for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14, 3.15.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Nov 4, 2026

Copy link
Copy Markdown

Sorry, @iamsaugatpandey and @ZeroIntensity, I could not cleanly backport this to 3.15 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 44579b0da558b5a45b17358dffbc4a2ee947cdf7 3.15
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned ZeroIntensity Nov 4, 2026
@miss-islington-app

miss-islington-app Bot commented Nov 4, 2026

Copy link
Copy Markdown

Sorry, @iamsaugatpandey and @ZeroIntensity, I could not cleanly backport this to 3.14 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 44579b0da558b5a45b17358dffbc4a2ee947cdf7 3.14
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Nov 11, 2026

Copy link
Copy Markdown

GH-161806 is a backport of this pull request to the 3.15 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Nov 11, 2026
@iamsaugatpandey

iamsaugatpandey commented Nov 11, 2026

Copy link
Copy Markdown
Contributor Author

@ZeroIntensity I've done the manual backports:

  • 3.15: [3.15] gh-160708: Use the type size for resized ctypes simple objects (GH-160720) #161806
  • 3.14: the branch is pushed (backport-44579b0-3.14), but GitHub won't let me open the PR right now (it looks like I've hit the open PR limit). I'll open it as soon as one of my other PRs closes.

The only conflict was Simple_bool, which isn't converted to Argument Clinic on those branches. I look up info before Py_BEGIN_CRITICAL_SECTION and do the byte loop inside it, using break instead of return so the critical section is always ended. The rest applied cleanly. test_ctypes passes on both branches, and the new tests fail there without the fix.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
ZeroIntensity added a commit that referenced this pull request Nov 11, 2026
@iamsaugatpandey @ZeroIntensity
[3.15] gh-160708: Use the type size for resized ctypes simple objects (…
f539f34 
…GH-160720) (GH-161806)

After ctypes.resize(), a simple object's buffer is larger than its
type. bool() and passing the object to a foreign function still used
the buffer size, so bool() read past a 16-byte string literal and the
call copied the whole buffer into the fixed-size PyCArgObject value,
corrupting the heap.

Use the type's size instead, like the value getter does since
gh-159739. bool() now checks the value's bytes directly, which also
covers simple types larger than 16 bytes such as c_longdouble_complex
on x86-64.
(cherry picked from commit 44579b0)

Co-authored-by: Peter Bierma <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@ZeroIntensity ZeroIntensity ZeroIntensity approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@ZeroIntensity ZeroIntensity

Labels

needs backport to 3.14 bugs and security fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@iamsaugatpandey @ZeroIntensity
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.