Fix #109024: Off-by-1 in rna_access for non-array props without raw access #115967

Thomas Barlow · 2023-12-09T01:49:54+01:00

Thomas Barlow commented

2023-12-09 01:49:54 +01:00

The a + itemlen > in.len check was off-by-1 whenever accessing a
non-array property without raw access. This was because itemlen was
actually the array length of the property, which is 0 for non-array
properties.

Given an array which was too short, this would cause the slower loop to
overrun the end of the array by one item. When getting items this would
cause a crash on a debug build with Fatal Python error: _PyMem_DebugRawFree: bad trailing pad byte.

The semantics of the itemlen and arraylen variables have now been
swapped to be less confusing. So arraylen is now the array length of
the property and itemlen is now the item length of the property. The
arraylen variable has been given the same scope as itemlen so that
it can be used in the slower loop when raw access is not available.

The band-aid fix would have been to replace a + itemlen > in.len with a + (itemlen == 0 ? 1 : itemlen) > in.len, but I think this patch is a better idea.

The `a + itemlen > in.len` check was off-by-1 whenever accessing a non-array property without raw access. This was because `itemlen` was actually the array length of the property, which is `0` for non-array properties. Given an array which was too short, this would cause the slower loop to overrun the end of the array by one item. When getting items this would cause a crash on a debug build with `Fatal Python error: _PyMem_DebugRawFree: bad trailing pad byte`. The semantics of the `itemlen` and `arraylen` variables have now been swapped to be less confusing. So `arraylen` is now the array length of the property and `itemlen` is now the item length of the property. The `arraylen` variable has been given the same scope as `itemlen` so that it can be used in the slower loop when raw access is not available. --- The band-aid fix would have been to replace `a + itemlen > in.len` with `a + (itemlen == 0 ? 1 : itemlen) > in.len`, but I think this patch is a better idea.

Thomas Barlow added 1 commit 2023-12-09 01:50:00 +01:00

ed25adc3db Fix #109024 : Off-by-1 in rna_access for non-array props without raw access

The `a + itemlen > in.len` check was off-by-1 whenever accessing a
non-array property without raw access. This was because `itemlen` was
actually the array length of the property, which is `0` for non-array
properties.

Given an array which was too short, this would cause the slower loop to
overrun the end of the array by one item, causing a crash on a debug
build with `Fatal Python error: _PyMem_DebugRawFree: bad trailing pad
byte`.

The semantics of the `itemlen` and `arraylen` variables have now been
swapped to be less confusing. So `arraylen` is now the array length of
the property and `itemlen` is now the item length of the property. The
`arraylen` variable has been given the same scope as `itemlen` so that
it can be used in the slower loop when raw access is not available.

Iliya Katushenock added this to the Python API project 2023-12-09 11:07:06 +01:00

Thomas Barlow added 1 commit 2023-12-10 04:44:53 +01:00

e78c8fa210 Missed variable changes in previous commit

Thomas Barlow added 2 commits 2023-12-13 05:08:08 +01:00

4e58ea9079 Merge remote-tracking branch 'origin/main' into fix_109024_non_raw_non_array_off_by_one

55430e9666 Update the recently added enum array asserts to use `arraylen`

This patch swaps the semantics of `arraylen` and `itemlen` and the recently added asserts were using the old `itemlen`.

Merge conflict checking is in progress. Try again in few moments.

View command line instructions.

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u fix_109024_non_raw_non_array_off_by_one:Mysteryem-fix_109024_non_raw_non_array_off_by_one

git checkout Mysteryem-fix_109024_non_raw_non_array_off_by_one

Sign in to join this conversation.

No reviewers

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Fix #109024: Off-by-1 in rna_access for non-array props without raw access #115967

Checkout