NULL ptr deref in instance_dealloc

Open
#421 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
38/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
cpp, python
Domain
backend

Research direction

Start at src/object/class.cpp:337 and inspect the destruction sequence around instance_dealloc and its dynamic_cast. Reproduce the reported case with clang16, gcc13, and Python 3.11, then verify that destruction no longer leads to a null-pointer dereference or other use of the destroyed object.

Written by the indexing model from the issue text.

Description

Hi, we've recently triggered null pointer deref in that place, right on dynamic_cast. From the first glance code does not look correct, dynamic_cast occurs after explicitly calling destructor on object. In our combination of clang16, gcc13 and python3.11 (I don't know what exactly triggered this) this destructor compiles in such way that vtable pointer is set to 0 in the end, which does not work so well with dynamic_cast.

Using object after destroying it sound like UB anyway, can it be fixed somehow? Using dynamic_cast before calling object destructor?

Dominant language
C++
Stars
537
Forks
223
Avg merge
11h 22m
Merged PRs (30d)
2

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from boostorg/python

All issues in boostorg/python

Similar issues

More C++ issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.