metacall: metacallfmv uses iterator instead of index for signature_get_type, casting arguments to wrong parameter types

Open Beginner friendly
  • Is something wrong?
#964 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
65/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
c, python
Domain
backend

Research direction

The bug sits in metacallfmv (around line 1675 of source/metacall/source/metacall.c) and metacallfmv_await_s (around line 2018), where the parameter type lookup uses the loop variable iterator rather than the resolved index. Read how signature_get_index and signature_get_type are used together in those functions, then reproduce with a two-parameter function of different types called with reversed JSON keys via metacallfms. Done means the arguments are cast against the type at index and the args array is fully initialized before function_call.

Written by the indexing model from the issue text.

Description

🐛 Bug Report

In source/metacall/source/metacall.c, metacallfmv and metacallfmv_await_s use the loop variable iterator instead of the resolved signature parameter index when retrieving the target parameter's type.

As a result, whenever a function is called with map/dictionary arguments in an order different from its signature declaration (which is standard for JSON and dictionary calls in metacallfms), arguments are type-checked and cast against the wrong parameter types.

Expected Behavior

When calling a function with named arguments (e.g., via metacallfmv or metacallfms with JSON {"b": 42, "a": "hello"} for fn(a: string, b: int)):

  1. index = signature_get_index(s, "b") resolves to 1.
  2. The argument value 42 should be type-cast against the type of parameter index (int).
  3. args[1] receives the value.
Current Behavior

In source/metacall/source/metacall.c at line 1675 (metacallfmv):

/* Obtain signature index */
if (type_id_string(key_id) == 0)
{
    const char *key = value_to_string(keys[iterator]);
    index = signature_get_index(s, key);
}
...

/* If index is valid, cast values and build arguments */
if (index < METACALL_ARGS_SIZE)
{
    type t = signature_get_type(s, iterator); // <--- BUG: uses iterator instead of index!

    if (t != NULL)
    {
        type_id id = type_index(t);

        if (id != value_type_id((value)values[iterator]))
        {
            value cast_arg = value_type_cast((value)values[iterator], id);
            if (cast_arg != NULL)
            {
                values[iterator] = cast_arg;
            }
        }
    }

    args[index] = values[iterator];
}

And identically at line 2018 in metacallfmv_await_s:

type t = signature_get_type(s, iterator); // <--- BUG: uses iterator instead of index!

Because iterator is the loop index across the caller's keys[] array rather than the parameter's position in the signature:

  • values[0] (intended for parameter at index = 1) is checked and cast against signature_get_type(s, 0).
  • values[1] (intended for parameter at index = 0) is checked and cast against signature_get_type(s, 1).

If the parameter types differ (e.g. String and Int), MetaCall either attempts an invalid cast or passes the wrong type into args[index].

Additional Finding: Uninitialized Stack Pointer Exposure

In both metacallfmv (line 1618) and metacallfmv_await_s (line 1961):

void *args[METACALL_ARGS_SIZE];

args is declared without initialization. If the caller provides duplicate keys (mapping multiple times to the same index) or if keys do not cover all 0 .. args_count - 1 indices, any unpopulated slot in args contains uninitialized stack memory, which is then passed directly to function_call(f, args, args_count).

Steps to Reproduce
  1. Define a function in any loader (e.g., Python or Node) with two parameters of different types: 
    def greet(name: str, count: int):
    return f"{name} " * count
  2. Call greet via metacallfms with JSON keys in reverse order: 
    {"count": 3, "name": "hello"}
  3. metacallfms parses the JSON map:
    • iterator = 0: key = "count", value = 3.
    • index = signature_get_index(s, "count") -> 1.
    • t = signature_get_type(s, iterator) -> fetches type of parameter 0 (name, String)!
    • value_type_cast(3, TYPE_STRING) is attempted for parameter 1.
  4. The call either fails type validation or passes corrupted argument types to the loader.
Proposed Solution
  1. Replace signature_get_type(s, iterator) with signature_get_type(s, index) in both metacallfmv (line 1675) and metacallfmv_await_s (line 2018).
  2. Zero-initialize args: 
    void *args[METACALL_ARGS_SIZE] = { NULL };
    and ensure all required positions 0 .. args_count - 1 are populated before calling function_call.
Dominant language
C
Stars
1.8k
Forks
266
Avg merge
2d 16h
Merged PRs (30d)
14

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from metacall/core

All issues in metacall/core

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.