New submission from Steve Dower:
Modules/_ctypes/cfield.c has this horror in it (twice):
/* XXX What about invalid pointers ??? */
if (*(void **)ptr) {
#if defined(MS_WIN32) && !defined(_WIN32_WCE)
if (IsBadStringPtrA(*(char **)ptr, -1)) {
PyErr_Format(PyExc_ValueError,
"invalid string pointer %p",
*(char **)ptr);
return NULL;
}
#endif
return PyBytes_FromStringAndSize(*(char **)ptr,
strlen(*(char **)ptr));
IsBadStringPtr should generally not be used, and the -1 parameter makes it even
worse. See http://blogs.msdn.com/b/oldnewthing/archive/2006/09/27/773741.aspx
for details, but the main reason is that if it is actually a bad pointer, we've
just deferred the crash from the obvious location to somewhere that should
"never" crash.
The strlen() call has exactly the same behaviour as IsBadStringPtrA except the
crash will occur here.
A better alternative would be to use the safe strlen function to limit the
maximum length of strings, but since we likely can't agree on a suitable
maximum we should just stop trying to handle this case at all.
----------
assignee: steve.dower
components: Windows, ctypes
messages: 239167
nosy: steve.dower, tim.golden, zach.ware
priority: normal
severity: normal
stage: needs patch
status: open
title: Remove IsBadStringPtr calls in ctypes
type: enhancement
_______________________________________
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue23765>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
