kivy / pyobjus / 40073722258
70%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 6
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 48.062%. Remained the same
40073722258

push

github

web-flow 
Fix struct arguments passed by value: heap overrun and truncated copy (#157)

* Fix heap overrun when passing a struct larger than 16 bytes by value

ObjcMethod.__call__ sized each argument buffer from the argument's ffi_type,
but a struct ffi_type built by type_encoding_to_ffitype has size 0 until
ffi_prep_cif lays it out, which happens later, on a different copy of the
type. cast_to_cy_data_type therefore copied the struct into malloc(0). Apple's
allocator rounds that up to 16 bytes, so CGPoint, CGSize and NSRange fit by
luck, but a 32-byte CGRect overran the block: its origin survived and its
size could be overwritten by the next allocation, the return-value buffer in
the same size class. The visible result is a frame that arrives as
(x, y, 0, 0) on some runs and intact on others, plus heap corruption.

Size struct and union arguments from their ctypes type instead, with a floor
of one pointer because a None argument is written as a nil pointer. The
ffi_type itself is left at size 0, which libffi needs in order to compute the
layout.

The normal allocator usually hides the overrun, so the regression test runs
NSValue.valueWithRect_ in a subprocess under Guard Malloc, where the old code
crashes with SIGSEGV on the first call. The full suite also passes under
Guard Malloc.

Closes #90

Co-authored-by: Cursor <cursoragent@cursor.com>

* Copy the whole struct when passing an unregistered struct by value

cast_to_cy_data_type copies CGRect, CGPoint, CGSize and NSRange by type, but
any other struct fell through to a branch that copied one pointer-sized word,
so only the first 8 bytes reached Objective-C. A 32-byte NSEdgeInsets or
UIEdgeInsets arrived as (top, 0, 0, 0). Copy size bytes instead; size now
comes from the struct's ctypes type.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Elliot Garbus <elliotgarbus@Elliots-MacBook-Pro.local>
Co-authored-by: Cursor <cursoragent@cursor.com>

124 of 258 relevant lines covered (48.06%)

0.48 hits per line

Jobs
ID Job ID Ran Files Coverage
1 40073722258.1 6
48.06
GitHub Action Run
Source Files on build 40073722258