enthought / enthought/comtypes

List-index access to COM object array crashes python

Open
#17 1 comment 1 reaction 0 assignees View on GitHub
bug
Dominant language
Python
Stars
345
Forks
105
PR merge metrics
No merged PRs in 30d

Description

This bug happened to me a year ago so I'm a little fuzzy on exactly what happened, but it was a doozy. Here is some code that repros the bug

``` python
items = (POINTER(IWiaItem) * NUM_OBJECTS_TO_REQUEST)()
num_fetched = enum.Next(NUM_OBJECTS_TO_REQUEST, items)
print items[0]
print items[0]
```

where enum.Next has a signature of

```
COMMETHOD([], HRESULT, 'Next',
( ['in'], ULONG, 'celt'),
( ['in, out'], POINTER(POINTER(IWiaItem)), 'ppIWiaItem'),
( ['out'], POINTER(ULONG), 'pceltFetched'))
```

The array items is an array of IWiaItems. When you do items[0], it helpfully turns the thing into an actual IWiaItem object for you to use, but when that object is destroyed, we call __com_Release. So when you do items[0] the second time, it does Release again (and it only did AddReference once). So eventually, crash! Yay.
Another user reported same in the user reviews on https://sourceforge.net/projects/comtypes/.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.