python / python/cpython

Various UB warnings found by UBSan

Open
#148,286 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

extension-modules interpreter-core type-bug
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:

These were all found by UBSan in our CI (it just hasn't been complaining about them). They need to be individually checked, some may be false positives.

# Objects/object.c:97:5: runtime error: member access within null pointer of type 'PyThreadState' (aka 'struct _ts')
null:Objects/object.c

In test_memoryview:

# Objects/memoryobject.c:3032:15: runtime error: load of value 2, which is not a valid value for type 'bool'
bool:Objects/memoryobject.c

In test_ctypes:

# Modules/_ctypes/cfield.c:644:1: runtime error: left shift of 1 by 63 places cannot be represented in type 'int64_t' (aka 'long')
shift-base:Modules/_ctypes/cfield.c

# Modules/_ctypes/cfield.c:640:1: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
signed-integer-overflow:Modules/_ctypes/cfield.c

In test_zstd:

# Modules/_zstd/decompressor.c:598:56: runtime error: applying non-zero offset 18446744073709551615 to null pointer
pointer-overflow:Modules/_zstd/decompressor.c
# Modules/_io/stringio.c:350:24: runtime error: addition of unsigned offset to 0x7fd01ec25850 overflowed to 0x7fd01ec2584c
pointer-overflow:Modules/_io/stringio.c
# Objects/bytesobject.c:1190:25: runtime error: applying zero offset to null pointer
pointer-overflow:Objects/bytesobject.c
CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs
  • gh-151274
  • gh-148168
  • gh-153187
  • gh-153204
  • gh-153258
  • gh-153644
  • gh-153645
  • gh-154912
  • gh-154913
  • gh-154915
  • gh-154926

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the UBSan reports and the named locations in Objects/object.c, Objects/memoryobject.c, Modules/_ctypes/cfield.c, Modules/_zstd/decompressor.c, Modules/_io/stringio.c, and Objects/bytesobject.c. Run the relevant UBSan CI tests, then determine which warnings are valid or false positives and verify each has been addressed. Linked PRs indicate that work is already under way.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
testing-qa
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
15/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.