Skip to content

Fix ownership issue for string_pointer and buffer overrun issue for string_array. (#472) #474

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fixed support for UTF8.
Fixed missing support for based_attribute.

Modified the description of SetStringPointer.
  • Loading branch information
CookStar committed May 23, 2023
commit 88f708a37b99e5a6ee61fa461ccad3fd137b7631
Original file line number Diff line number Diff line change
Expand Up @@ -359,7 +359,8 @@ def _get_server_class(self, class_name, datamap):
attribute = method(
Key.as_attribute_type(self, data['type']),
offset,
data.get('doc')
data.get('doc'),
Key.as_int(self, data.get('length', 0)),
)

# Assign the attribute to the instance
Expand Down
6 changes: 3 additions & 3 deletions addons/source-python/packages/source-python/memory/manager.py
Original file line number Diff line number Diff line change
Expand Up @@ -479,7 +479,7 @@ def fset(ptr, value):

# Handle string array type
elif type_name == Type.STRING_ARRAY:
if length and len(value) >= length:
if length and len(value.encode()) >= length:
raise ValueError(
'The string length exceeds'
'the limit "{0}".'.format(length-1))
Expand Down Expand Up @@ -533,7 +533,7 @@ def fset(ptr, value):
if not instance_ptr:
# Allocate space for the value
if type_name == Type.STRING_ARRAY:
size = length if length else len(value) + 1
size = length if length else len(value.encode()) + 1
else:
size = TYPE_SIZES[type_name.upper()]

Expand All @@ -558,7 +558,7 @@ def fset(ptr, value):

# Handle string array type
elif type_name == Type.STRING_ARRAY:
if length and len(value) >= length:
if length and len(value.encode()) >= length:
raise ValueError(
'The string length exceeds'
'the limit "{0}".'.format(length-1))
Expand Down
20 changes: 15 additions & 5 deletions src/core/modules/memory/memory_pointer.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -105,14 +105,24 @@ const char * CPointer::GetStringPointer(int iOffset /* = 0 */)
CPointer * CPointer::SetStringPointer(str oString, int iOffset /* = 0 */)
{
Validate();
unsigned long length = len(oString) + 1;
CPointer * pPtr = new CPointer((unsigned long) UTIL_Alloc(length), false);
char * value = (char *) pPtr->m_ulAddr;
memcpy(value, extract<const char *>(oString), length);

// Encode Unicode object and extract Python bytes object.
PyObject * pObj = PyUnicode_AsUTF8String(oString.ptr());
if (!pObj)
BOOST_RAISE_EXCEPTION(PyExc_ValueError, "Invalid UTF-8 string.");

// Get string and length of bytes.
const char * szString = PyBytes_AS_STRING(pObj);
unsigned long length = PyBytes_GET_SIZE(pObj) + 1;

char * value = (char *) UTIL_Alloc(length);
memcpy(value, szString, length);

TRY_SEGV()
*(const char **) (m_ulAddr + iOffset) = value;
EXCEPT_SEGV()
return pPtr;

return new CPointer((unsigned long) value, false);
}

const char * CPointer::GetStringArray(int iOffset /* = 0 */)
Expand Down
2 changes: 1 addition & 1 deletion src/core/modules/memory/memory_wrap.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -229,7 +229,7 @@ void export_pointer(scope _memory)

.def("set_string_pointer",
&CPointer::SetStringPointer,
"Sets the value at the given memory location. This string object must be deallocated by the user. Returns the string object.",
"Sets the value at the given memory location. Returns the string object. This string object must be deallocated by the user.",
("value", arg( "offset")=0),
manage_new_object_policy()
)
Expand Down