gh-111178: Avoid calling functions from incompatible pointer types in listobject.c #112820

chrstphrchvz · 2023-12-07T01:50:12Z

Issue: UBSan: Calling a function through pointer to incorrect function type is undefined behavior #111178

Objects/listobject.c:3167:5: warning: cast from 'PyObject *(*)(PyListObject *)' (aka 'struct _object *(*)(PyListObject *)') to 'reprfunc' (aka 'struct _object *(*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict] 3167 | (reprfunc)list_repr, /* tp_repr */ | ^~~~~~~~~~~~~~~~~~~ Example UBSan -fsanitize=function error: Objects/object.c:674:11: runtime error: call to function list_repr through pointer to incorrect function type 'struct _object *(*)(struct _object *)' listobject.c:382: note: list_repr defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/object.c:674:11 in

Objects/listobject.c:3162:5: warning: cast from 'void (*)(PyListObject *)' to 'destructor' (aka 'void (*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict] 3162 | (destructor)list_dealloc, /* tp_dealloc */ | ^~~~~~~~~~~~~~~~~~~~~~~~ Example UBSan error: Objects/object.c:2857:5: runtime error: call to function list_dealloc through pointer to incorrect function type 'void (*)(struct _object *)' listobject.c:347: note: list_dealloc defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/object.c:2857:5 in

Objects/listobject.c:3181:5: warning: cast from 'int (*)(PyListObject *, visitproc, void *)' (aka 'int (*)(PyListObject *, int (*)(struct _object *, void *), void *)') to 'traverseproc' (aka 'int (*)(struct _object *, int (*)(struct _object *, void *), void *)') converts to incompatible function type [-Wcast-function-type-strict] 3181 | (traverseproc)list_traverse, /* tp_traverse */ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ Example UBSan error: Modules/gcmodule.c:493:16: runtime error: call to function list_traverse through pointer to incorrect function type 'int (*)(struct _object *, int (*)(struct _object *, void *), void *)' listobject.c:2760: note: list_traverse defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Modules/gcmodule.c:493:16 in

Objects/listobject.c:3182:5: warning: cast from 'int (*)(PyListObject *)' to 'inquiry' (aka 'int (*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict] 3182 | (inquiry)list_clear_slot, /* tp_clear */ | ^~~~~~~~~~~~~~~~~~~~~~~~ Example UBSan error: Modules/gcmodule.c:1033:24: runtime error: call to function list_clear_slot through pointer to incorrect function type 'int (*)(struct _object *)' listobject.c:620: note: list_clear_slot defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Modules/gcmodule.c:1033:24 in

Objects/listobject.c:2928:5: warning: cast from 'int (*)(PyListObject *, Py_ssize_t, PyObject *)' (aka 'int (*)(PyListObject *, long, struct _object *)') to 'ssizeobjargproc' (aka 'int (*)(struct _object *, long, struct _object *)') converts to incompatible function type [-Wcast-function-type-strict] 2928 | (ssizeobjargproc)list_ass_item, /* sq_ass_item */ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Example UBSan error: Objects/abstract.c:2032:19: runtime error: call to function list_ass_item through pointer to incorrect function type 'int (*)(struct _object *, long, struct _object *)' listobject.c:780: note: list_ass_item defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/abstract.c:2032:19 in

Objects/listobject.c:3251:5: warning: cast from 'PyObject *(*)(_PyListIterObject *)' (aka 'struct _object *(*)(_PyListIterObject *)') to 'iternextfunc' (aka 'struct _object *(*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict] 3251 | (iternextfunc)listiter_next, /* tp_iternext */ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ Example UBSan error: Objects/typeobject.c:8150:11: runtime error: call to function listiter_next through pointer to incorrect function type 'struct _object *(*)(struct _object *)' listobject.c:3292: note: listiter_next defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/typeobject.c:8150:11 in

Objects/listobject.c:2923:5: warning: cast from 'Py_ssize_t (*)(PyListObject *)' (aka 'long (*)(PyListObject *)') to 'lenfunc' (aka 'long (*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict] 2923 | (lenfunc)list_length, /* sq_length */ | ^~~~~~~~~~~~~~~~~~~~ Objects/listobject.c:3152:5: warning: cast from 'Py_ssize_t (*)(PyListObject *)' (aka 'long (*)(PyListObject *)') to 'lenfunc' (aka 'long (*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict] 3152 | (lenfunc)list_length, | ^~~~~~~~~~~~~~~~~~~~ Example UBSan error: Objects/object.c:1820:15: runtime error: call to function list_length through pointer to incorrect function type 'long (*)(struct _object *)' listobject.c:438: note: list_length defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/object.c:1820:15 in

Objects/listobject.c:3229:5: warning: cast from 'void (*)(_PyListIterObject *)' to 'destructor' (aka 'void (*)(struct _object *)') converts to incompatible function type [-Wcast-function-type-strict] 3229 | (destructor)listiter_dealloc, /* tp_dealloc */ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ Example UBSan error: Python/generated_cases.c.h:3322:21: runtime error: call to function listiter_dealloc through pointer to incorrect function type 'void (*)(struct _object *)' listobject.c:3222: note: listiter_dealloc defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Python/generated_cases.c.h:3322:21 in

Objects/listobject.c:2924:5: warning: cast from 'PyObject *(*)(PyListObject *, PyObject *)' (aka 'struct _object *(*)(PyListObject *, struct _object *)') to 'binaryfunc' (aka 'struct _object *(*)(struct _object *, struct _object *)') converts to incompatible function type [-Wcast-function-type-strict] 2924 | (binaryfunc)list_concat, /* sq_concat */ | ^~~~~~~~~~~~~~~~~~~~~~~ Objects/listobject.c:2925:5: warning: cast from 'PyObject *(*)(PyListObject *, Py_ssize_t)' (aka 'struct _object *(*)(PyListObject *, long)') to 'ssizeargfunc' (aka 'struct _object *(*)(struct _object *, long)') converts to incompatible function type [-Wcast-function-type-strict] 2925 | (ssizeargfunc)list_repeat, /* sq_repeat */ | ^~~~~~~~~~~~~~~~~~~~~~~~~ Objects/listobject.c:2926:5: warning: cast from 'PyObject *(*)(PyListObject *, Py_ssize_t)' (aka 'struct _object *(*)(PyListObject *, long)') to 'ssizeargfunc' (aka 'struct _object *(*)(struct _object *, long)') converts to incompatible function type [-Wcast-function-type-strict] 2926 | (ssizeargfunc)list_item, /* sq_item */ | ^~~~~~~~~~~~~~~~~~~~~~~ Example UBSan errors: Objects/abstract.c:1137:18: runtime error: call to function list_concat through pointer to incorrect function type 'struct _object *(*)(struct _object *, struct _object *)' listobject.c:518: note: list_concat defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/abstract.c:1137:18 in Objects/abstract.c:1159:21: runtime error: call to function list_repeat through pointer to incorrect function type 'struct _object *(*)(struct _object *, long)' listobject.c:558: note: list_repeat defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/abstract.c:1159:21 in Objects/abstract.c:1946:25: runtime error: call to function list_item through pointer to incorrect function type 'struct _object *(*)(struct _object *, long)' listobject.c:462: note: list_item defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/abstract.c:1946:25 in

Objects/listobject.c:2956:26: warning: incompatible pointer types passing 'PyListObject *' to parameter of type 'PyObject *' (aka 'struct _object *') [-Wincompatible-pointer-types] 2956 | return list_item(self, i); | ^~~~

encukou

I'm not a fan of the aa name. For the future PRs, I propose using _self for “self argument of the wrong type, only to be used once in a cast”.
But let's not make that block this PR; aa does match the existing names here.

…pes in listobject.c (pythonGH-112820) Fix undefined behavior warnings (UBSan -fsanitize=function), for example: Objects/object.c:674:11: runtime error: call to function list_repr through pointer to incorrect function type 'struct _object *(*)(struct _object *)' listobject.c:382: note: list_repr defined here SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Objects/object.c:674:11 in

chrstphrchvz added 26 commits December 6, 2023 19:42

Make list_subscript() compatible with PyCFunction and binaryfunc

7fc9eaf

Make listreviter_traverse() compatible with traverseproc

5dbaa7e

Make listreviter_dealloc() compatible with destructor

825867b

Make listreviter_next() compatible with iternextfunc

77927e5

Make listiter_traverse() compatible with traverseproc

6dd4236

Make listreviter_len() compatible with PyCFunction

8b6babf

Make listreviter_reduce() compatible with PyCFunction

e20d180

Make listreviter_setstate() compatible with PyCFunction

aceb958

Make list_contains() compatible with objobjproc

0532044

Make list_inplace_concat() compatible with binaryfunc

7ef5480

Make list_ass_subscript() compatible with objobjargproc

6445fc6

Make listiter_len() compatible with PyCFunction

fc9fccb

Make listiter_reduce() compatible with PyCFunction

2dd6685

Make listiter_setstate() compatible with PyCFunction

bf28e3e

Fix warning in list_subscript()

15f1bfc

Objects/listobject.c:2956:26: warning: incompatible pointer types passing 'PyListObject *' to parameter of type 'PyObject *' (aka 'struct _object *') [-Wincompatible-pointer-types] 2956 | return list_item(self, i); | ^~~~

Make list_inplace_repeat() compatible with ssizeargfunc

720c908

Slightly less inconsistent parameter names

d2bea5b

bedevere-app bot added the awaiting review label Dec 7, 2023

bedevere-app bot mentioned this pull request Dec 7, 2023

UBSan: Calling a function through pointer to incorrect function type is undefined behavior #111178

Open

Eclips4 requested review from vstinner and encukou December 7, 2023 11:23

encukou added the skip news label Dec 11, 2023

encukou approved these changes Jan 2, 2024

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting review labels Jan 2, 2024

encukou merged commit 5d36a95 into python:main Jan 2, 2024
30 checks passed

bedevere-app bot removed the awaiting merge label Jan 2, 2024

chrstphrchvz deleted the patch-111178-listobject branch January 2, 2024 14:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gh-111178: Avoid calling functions from incompatible pointer types in listobject.c #112820

gh-111178: Avoid calling functions from incompatible pointer types in listobject.c #112820

chrstphrchvz commented Dec 7, 2023 •

edited by bedevere-app bot

Loading

encukou left a comment

gh-111178: Avoid calling functions from incompatible pointer types in listobject.c #112820

gh-111178: Avoid calling functions from incompatible pointer types in listobject.c #112820

Conversation

chrstphrchvz commented Dec 7, 2023 • edited by bedevere-app bot Loading

encukou left a comment

Choose a reason for hiding this comment

chrstphrchvz commented Dec 7, 2023 •

edited by bedevere-app bot

Loading