Issue #3139: Make buffer-interface thread-safe wrt. PyArg_ParseTuple,
by denying s# to parse objects that have a releasebuffer procedure,
and introducing s*.
More module might need to get converted to use s*.
diff --git a/Objects/abstract.c b/Objects/abstract.c
index 5cabe58..5fb89f3 100644
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -362,16 +362,6 @@
return (*(obj->ob_type->tp_as_buffer->bf_getbuffer))(obj, view, flags);
}
-void
-PyObject_ReleaseBuffer(PyObject *obj, Py_buffer *view)
-{
- if (obj->ob_type->tp_as_buffer != NULL &&
- obj->ob_type->tp_as_buffer->bf_releasebuffer != NULL) {
- (*(obj->ob_type->tp_as_buffer->bf_releasebuffer))(obj, view);
- }
-}
-
-
static int
_IsFortranContiguous(Py_buffer *view)
{
@@ -603,15 +593,15 @@
if (PyObject_GetBuffer(dest, &view_dest, PyBUF_FULL) != 0) return -1;
if (PyObject_GetBuffer(src, &view_src, PyBUF_FULL_RO) != 0) {
- PyObject_ReleaseBuffer(dest, &view_dest);
+ PyBuffer_Release(&view_dest);
return -1;
}
if (view_dest.len < view_src.len) {
PyErr_SetString(PyExc_BufferError,
"destination is too small to receive data from source");
- PyObject_ReleaseBuffer(dest, &view_dest);
- PyObject_ReleaseBuffer(src, &view_src);
+ PyBuffer_Release(&view_dest);
+ PyBuffer_Release(&view_src);
return -1;
}
@@ -621,8 +611,8 @@
PyBuffer_IsContiguous(&view_src, 'F'))) {
/* simplest copy is all that is needed */
memcpy(view_dest.buf, view_src.buf, view_src.len);
- PyObject_ReleaseBuffer(dest, &view_dest);
- PyObject_ReleaseBuffer(src, &view_src);
+ PyBuffer_Release(&view_dest);
+ PyBuffer_Release(&view_src);
return 0;
}
@@ -632,8 +622,8 @@
indices = (Py_ssize_t *)PyMem_Malloc(sizeof(Py_ssize_t)*view_src.ndim);
if (indices == NULL) {
PyErr_NoMemory();
- PyObject_ReleaseBuffer(dest, &view_dest);
- PyObject_ReleaseBuffer(src, &view_src);
+ PyBuffer_Release(&view_dest);
+ PyBuffer_Release(&view_src);
return -1;
}
for (k=0; k<view_src.ndim;k++) {
@@ -651,8 +641,8 @@
memcpy(dptr, sptr, view_src.itemsize);
}
PyMem_Free(indices);
- PyObject_ReleaseBuffer(dest, &view_dest);
- PyObject_ReleaseBuffer(src, &view_src);
+ PyBuffer_Release(&view_dest);
+ PyBuffer_Release(&view_src);
return 0;
}
@@ -681,7 +671,7 @@
}
int
-PyBuffer_FillInfo(Py_buffer *view, void *buf, Py_ssize_t len,
+PyBuffer_FillInfo(Py_buffer *view, PyObject *obj, void *buf, Py_ssize_t len,
int readonly, int flags)
{
if (view == NULL) return 0;
@@ -692,6 +682,7 @@
return -1;
}
+ view->obj = obj;
view->buf = buf;
view->len = len;
view->readonly = readonly;
@@ -711,6 +702,17 @@
return 0;
}
+void
+PyBuffer_Release(Py_buffer *view)
+{
+ PyObject *obj = view->obj;
+ if (!obj || !Py_TYPE(obj)->tp_as_buffer || !Py_TYPE(obj)->tp_as_buffer->bf_releasebuffer)
+ /* Unmanaged buffer */
+ return;
+ Py_TYPE(obj)->tp_as_buffer->bf_releasebuffer(obj, view);
+
+}
+
PyObject *
PyObject_Format(PyObject* obj, PyObject *format_spec)
{
diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c
index bc02106..9ff4458 100644
--- a/Objects/bytearrayobject.c
+++ b/Objects/bytearrayobject.c
@@ -123,7 +123,7 @@
ptr = "";
else
ptr = obj->ob_bytes;
- ret = PyBuffer_FillInfo(view, ptr, Py_SIZE(obj), 0, flags);
+ ret = PyBuffer_FillInfo(view, (PyObject*)obj, ptr, Py_SIZE(obj), 0, flags);
if (ret >= 0) {
obj->ob_exports++;
}
@@ -302,9 +302,9 @@
done:
if (va.len != -1)
- PyObject_ReleaseBuffer(a, &va);
+ PyBuffer_Release(&va);
if (vb.len != -1)
- PyObject_ReleaseBuffer(b, &vb);
+ PyBuffer_Release(&vb);
return (PyObject *)result;
}
@@ -332,7 +332,7 @@
mysize = Py_SIZE(self);
size = mysize + vo.len;
if (size < 0) {
- PyObject_ReleaseBuffer(other, &vo);
+ PyBuffer_Release(&vo);
return PyErr_NoMemory();
}
if (size < self->ob_alloc) {
@@ -340,11 +340,11 @@
self->ob_bytes[Py_SIZE(self)] = '\0'; /* Trailing null byte */
}
else if (PyByteArray_Resize((PyObject *)self, size) < 0) {
- PyObject_ReleaseBuffer(other, &vo);
+ PyBuffer_Release(&vo);
return NULL;
}
memcpy(self->ob_bytes + mysize, vo.buf, vo.len);
- PyObject_ReleaseBuffer(other, &vo);
+ PyBuffer_Release(&vo);
Py_INCREF(self);
return (PyObject *)self;
}
@@ -555,7 +555,7 @@
finish:
if (vbytes.len != -1)
- PyObject_ReleaseBuffer(values, &vbytes);
+ PyBuffer_Release(&vbytes);
return res;
}
@@ -841,10 +841,10 @@
if (PyByteArray_Resize((PyObject *)self, size) < 0) goto fail;
if (PyBuffer_ToContiguous(self->ob_bytes, &view, size, 'C') < 0)
goto fail;
- PyObject_ReleaseBuffer(arg, &view);
+ PyBuffer_Release(&view);
return 0;
fail:
- PyObject_ReleaseBuffer(arg, &view);
+ PyBuffer_Release(&view);
return -1;
}
@@ -1031,7 +1031,7 @@
other_size = _getbuffer(other, &other_bytes);
if (other_size < 0) {
PyErr_Clear();
- PyObject_ReleaseBuffer(self, &self_bytes);
+ PyBuffer_Release(&self_bytes);
Py_INCREF(Py_NotImplemented);
return Py_NotImplemented;
}
@@ -1066,8 +1066,8 @@
}
res = cmp ? Py_True : Py_False;
- PyObject_ReleaseBuffer(self, &self_bytes);
- PyObject_ReleaseBuffer(other, &other_bytes);
+ PyBuffer_Release(&self_bytes);
+ PyBuffer_Release(&other_bytes);
Py_INCREF(res);
return res;
}
@@ -1075,6 +1075,11 @@
static void
bytes_dealloc(PyByteArrayObject *self)
{
+ if (self->ob_exports > 0) {
+ PyErr_SetString(PyExc_SystemError,
+ "deallocated bytearray object has exported buffers");
+ PyErr_Print();
+ }
if (self->ob_bytes != 0) {
PyMem_Free(self->ob_bytes);
}
@@ -1142,7 +1147,7 @@
res = stringlib_rfind_slice(
PyByteArray_AS_STRING(self), PyByteArray_GET_SIZE(self),
subbuf.buf, subbuf.len, start, end);
- PyObject_ReleaseBuffer(subobj, &subbuf);
+ PyBuffer_Release(&subbuf);
return res;
}
@@ -1192,7 +1197,7 @@
count_obj = PyInt_FromSsize_t(
stringlib_count(str + start, end - start, vsub.buf, vsub.len)
);
- PyObject_ReleaseBuffer(sub_obj, &vsub);
+ PyBuffer_Release(&vsub);
return count_obj;
}
@@ -1268,7 +1273,7 @@
return -1;
pos = stringlib_find(PyByteArray_AS_STRING(self), Py_SIZE(self),
varg.buf, varg.len, 0);
- PyObject_ReleaseBuffer(arg, &varg);
+ PyBuffer_Release(&varg);
return pos >= 0;
}
if (ival < 0 || ival >= 256) {
@@ -1318,7 +1323,7 @@
rv = ! memcmp(str+start, vsubstr.buf, vsubstr.len);
done:
- PyObject_ReleaseBuffer(substr, &vsubstr);
+ PyBuffer_Release(&vsubstr);
return rv;
}
@@ -1498,9 +1503,9 @@
PyByteArray_Resize(result, output - output_start);
done:
- PyObject_ReleaseBuffer(tableobj, &vtable);
+ PyBuffer_Release(&vtable);
if (delobj != NULL)
- PyObject_ReleaseBuffer(delobj, &vdel);
+ PyBuffer_Release(&vdel);
return result;
}
@@ -2122,7 +2127,7 @@
if (_getbuffer(from, &vfrom) < 0)
return NULL;
if (_getbuffer(to, &vto) < 0) {
- PyObject_ReleaseBuffer(from, &vfrom);
+ PyBuffer_Release(&vfrom);
return NULL;
}
@@ -2130,8 +2135,8 @@
vfrom.buf, vfrom.len,
vto.buf, vto.len, count);
- PyObject_ReleaseBuffer(from, &vfrom);
- PyObject_ReleaseBuffer(to, &vto);
+ PyBuffer_Release(&vfrom);
+ PyBuffer_Release(&vto);
return res;
}
@@ -2287,7 +2292,7 @@
if (n == 0) {
PyErr_SetString(PyExc_ValueError, "empty separator");
- PyObject_ReleaseBuffer(subobj, &vsub);
+ PyBuffer_Release(&vsub);
return NULL;
}
if (n == 1)
@@ -2295,7 +2300,7 @@
list = PyList_New(PREALLOC_SIZE(maxsplit));
if (list == NULL) {
- PyObject_ReleaseBuffer(subobj, &vsub);
+ PyBuffer_Release(&vsub);
return NULL;
}
@@ -2323,12 +2328,12 @@
#endif
SPLIT_ADD(s, i, len);
FIX_PREALLOC_SIZE(list);
- PyObject_ReleaseBuffer(subobj, &vsub);
+ PyBuffer_Release(&vsub);
return list;
onError:
Py_DECREF(list);
- PyObject_ReleaseBuffer(subobj, &vsub);
+ PyBuffer_Release(&vsub);
return NULL;
}
@@ -2519,7 +2524,7 @@
if (n == 0) {
PyErr_SetString(PyExc_ValueError, "empty separator");
- PyObject_ReleaseBuffer(subobj, &vsub);
+ PyBuffer_Release(&vsub);
return NULL;
}
else if (n == 1)
@@ -2527,7 +2532,7 @@
list = PyList_New(PREALLOC_SIZE(maxsplit));
if (list == NULL) {
- PyObject_ReleaseBuffer(subobj, &vsub);
+ PyBuffer_Release(&vsub);
return NULL;
}
@@ -2548,12 +2553,12 @@
FIX_PREALLOC_SIZE(list);
if (PyList_Reverse(list) < 0)
goto onError;
- PyObject_ReleaseBuffer(subobj, &vsub);
+ PyBuffer_Release(&vsub);
return list;
onError:
Py_DECREF(list);
- PyObject_ReleaseBuffer(subobj, &vsub);
+ PyBuffer_Release(&vsub);
return NULL;
}
@@ -2828,7 +2833,7 @@
else
right = rstrip_helper(myptr, mysize, argptr, argsize);
if (arg != Py_None)
- PyObject_ReleaseBuffer(arg, &varg);
+ PyBuffer_Release(&varg);
return PyByteArray_FromStringAndSize(self->ob_bytes + left, right - left);
}
@@ -2861,7 +2866,7 @@
left = lstrip_helper(myptr, mysize, argptr, argsize);
right = mysize;
if (arg != Py_None)
- PyObject_ReleaseBuffer(arg, &varg);
+ PyBuffer_Release(&varg);
return PyByteArray_FromStringAndSize(self->ob_bytes + left, right - left);
}
@@ -2894,7 +2899,7 @@
left = 0;
right = rstrip_helper(myptr, mysize, argptr, argsize);
if (arg != Py_None)
- PyObject_ReleaseBuffer(arg, &varg);
+ PyBuffer_Release(&varg);
return PyByteArray_FromStringAndSize(self->ob_bytes + left, right - left);
}
diff --git a/Objects/fileobject.c b/Objects/fileobject.c
index 7c49aff..a8e95a2 100644
--- a/Objects/fileobject.c
+++ b/Objects/fileobject.c
@@ -1007,6 +1007,7 @@
char *ptr;
Py_ssize_t ntodo;
Py_ssize_t ndone, nnow;
+ Py_buffer pbuf;
if (f->f_fp == NULL)
return err_closed();
@@ -1015,8 +1016,10 @@
(f->f_bufend - f->f_bufptr) > 0 &&
f->f_buf[0] != '\0')
return err_iterbuffered();
- if (!PyArg_ParseTuple(args, "w#", &ptr, &ntodo))
+ if (!PyArg_ParseTuple(args, "w*", &pbuf))
return NULL;
+ ptr = pbuf.buf;
+ ntodo = pbuf.len;
ndone = 0;
while (ntodo > 0) {
FILE_BEGIN_ALLOW_THREADS(f)
@@ -1029,11 +1032,13 @@
break;
PyErr_SetFromErrno(PyExc_IOError);
clearerr(f->f_fp);
+ PyBuffer_Release(&pbuf);
return NULL;
}
ndone += nnow;
ntodo -= nnow;
}
+ PyBuffer_Release(&pbuf);
return PyInt_FromSsize_t(ndone);
}
@@ -1611,17 +1616,26 @@
static PyObject *
file_write(PyFileObject *f, PyObject *args)
{
+ Py_buffer pbuf;
char *s;
Py_ssize_t n, n2;
if (f->f_fp == NULL)
return err_closed();
- if (!PyArg_ParseTuple(args, f->f_binary ? "s#" : "t#", &s, &n))
+ if (f->f_binary) {
+ if (!PyArg_ParseTuple(args, "s*", &pbuf))
+ return NULL;
+ s = pbuf.buf;
+ n = pbuf.len;
+ } else
+ if (!PyArg_ParseTuple(args, "t#", &s, &n))
return NULL;
f->f_softspace = 0;
FILE_BEGIN_ALLOW_THREADS(f)
errno = 0;
n2 = fwrite(s, 1, n, f->f_fp);
FILE_END_ALLOW_THREADS(f)
+ if (f->f_binary)
+ PyBuffer_Release(&pbuf);
if (n2 != n) {
PyErr_SetFromErrno(PyExc_IOError);
clearerr(f->f_fp);
diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index 6d53a09..5bf4add 100644
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -1328,7 +1328,8 @@
static int
string_buffer_getbuffer(PyStringObject *self, Py_buffer *view, int flags)
{
- return PyBuffer_FillInfo(view, (void *)self->ob_sval, Py_SIZE(self),
+ return PyBuffer_FillInfo(view, (PyObject*)self,
+ (void *)self->ob_sval, Py_SIZE(self),
1, flags);
}
@@ -1359,7 +1360,7 @@
};
-
+
#define LEFTSTRIP 0
#define RIGHTSTRIP 1
#define BOTHSTRIP 2
@@ -3996,7 +3997,7 @@
\n\
");
-
+
static PyMethodDef
string_methods[] = {
/* Counterparts of the obsolete stropmodule functions; except