amazon-ion / ion-python

A Python implementation of Amazon Ion.
https://amazon-ion.github.io/ion-docs/
Apache License 2.0
261 stars 51 forks source link

Invalid operation (segfault, sigbus, etc) when`ionc.ionc_write` is given more arguments than expected. #375

Closed nirosys closed 1 month ago

nirosys commented 1 month ago

Identified in #372.

Issue

(venv) glitch@147dda5e5395 ~/C/s/i/ion-python> python
Python 3.12.5 (main, Aug  6 2024, 19:08:49) [Clang 15.0.0 (clang-1500.1.0.2.5)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from amazon.ion import ionc
>>> ionc.ionc_write(None, True, False, False, None)
fish: Job 1, 'python' terminated by signal SIGBUS (Misaligned address error)

Looking at the code, it looks like the issue is the uninitialized PyObject pointers values at the top of ionc_write. In the event that the arguments are wrong, the function jumps down to the fail label, and pointers that are uninitialized get Py_DECREF'd.. which is probably what is generating the random segfault, and bus errors.

nirosys commented 1 month ago

Fixed with #376.