enthought / enthought/comtypes
List-index access to COM object array crashes python
- Dominant language
- Python
- Stars
- 345
- Forks
- 105
- PR merge metrics
- No merged PRs in 30d
Description
This bug happened to me a year ago so I'm a little fuzzy on exactly what happened, but it was a doozy. Here is some code that repros the bug
``` python
items = (POINTER(IWiaItem) * NUM_OBJECTS_TO_REQUEST)()
num_fetched = enum.Next(NUM_OBJECTS_TO_REQUEST, items)
print items[0]
print items[0]
```
where enum.Next has a signature of
```
COMMETHOD([], HRESULT, 'Next',
( ['in'], ULONG, 'celt'),
( ['in, out'], POINTER(POINTER(IWiaItem)), 'ppIWiaItem'),
( ['out'], POINTER(ULONG), 'pceltFetched'))
```
The array items is an array of IWiaItems. When you do items[0], it helpfully turns the thing into an actual IWiaItem object for you to use, but when that object is destroyed, we call __com_Release. So when you do items[0] the second time, it does Release again (and it only did AddReference once). So eventually, crash! Yay.
Another user reported same in the user reviews on https://sourceforge.net/projects/comtypes/.
Contributor guide
Assessment
This issue has not been assessed yet.