Skip to content

Commit bd01ee0

Browse files
godlygeekGus Monod
authored andcommitted
Fix a potential use-after-free bug
It'd be hard to trigger, and would require a race between threads, but this defends against the issue. Signed-off-by: Matt Wozniski <mwozniski@bloomberg.net>
1 parent 467128c commit bd01ee0

1 file changed

Lines changed: 9 additions & 1 deletion

File tree

comdb2/_ccdb2.pyx

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,9 +181,17 @@ cdef class _ParameterValue(object):
181181
(<double*>self.data)[l_index] = obj[l_index]
182182
return
183183
elif all(isinstance(ele, bytes) for ele in obj):
184+
if isinstance(obj, tuple):
185+
owner = obj
186+
else:
187+
# Copy the list into a tuple. If we referenced the list
188+
# directly, another thread could remove an element when
189+
# we drop the GIL, invalidating a pointer we're holding
190+
owner = tuple(obj)
191+
184192
self.type = lib.CDB2_BLOB
185193
self.size = sizeof(blob_descriptor)
186-
self.owner = obj
194+
self.owner = owner
187195
self.data = PyMem_Malloc(self.list_size * self.size)
188196
for l_index in range(self.list_size):
189197
(<blob_descriptor*>self.data)[l_index].size = len(obj[l_index])

0 commit comments

Comments
 (0)