Issue 13096: ctypes: segfault with large POINTER type names

Reproducible in 2.7 and tip:

[meadori@motherbrain cpython]$ ./python 
Python 3.3.0a0 (default:61de28fa5537+d05350c14e77+, Oct  3 2011, 21:47:04) 
[GCC 4.6.0 20110603 (Red Hat 4.6.0-10)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from ctypes import *
>>> T = type('x' * 2 ** 25, (Structure,), {})
>>> p = POINTER(T)
Segmentation fault (core dumped)

There is similar crasher to this one that can be reproduced like:

[meadori@motherbrain cpython]$ ./python 
Python 3.3.0a0 (default:61de28fa5537+d05350c14e77+, Oct  3 2011, 21:47:04) 
[GCC 4.6.0 20110603 (Red Hat 4.6.0-10)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from ctypes import *
>>> p = POINTER('x' * 2 ** 25)
Segmentation fault (core dumped)

It should be fixed as well.

The problem is around line 1734 of callproc.c in tip:

    } else if (PyType_Check(cls)) {
        typ = (PyTypeObject *)cls;
        buf = alloca(strlen(typ->tp_name) + 3 + 1);
        sprintf(buf, "LP_%s", typ->tp_name);   <-- segfault is here

Replacing the alloca with a malloc fixes it, so I presume it's hitting the stack size limit as 2^25 is 32MB (my stack limit is 8MB).

Yup, it is the 'alloca' call.  This issue and issue13097 are both 
'alloca' related as mentioned in issue12881.

Here is a small patch against tip.  OK?

Thanks for the report and patch, meador.inge.

I'd prefer not to add more globals that are only used in one place, but doing so is consistent with the existing style of test_pointers.py, and there's plenty in this file that could be cleaned up in another ticket.

* The patch passes `make patchcheck`.
* The full test suite passes with this patch.
* The reproducers in this issue segfault for me without this patch and do not segfault with this patch.

lgtm!

=> commit review

Thanks for the review and reminder about this issue, jesstess.  I will apply the patch later today.

New changeset e940bb13d010 by R David Murray in branch '3.4':
#13096: Fix segfault in CTypes POINTER handling of large values.
https://hg.python.org/cpython/rev/e940bb13d010

New changeset 02c9c3204a04 by R David Murray in branch 'default':
Merge: #13096: Fix segfault in CTypes POINTER handling of large values.
https://hg.python.org/cpython/rev/02c9c3204a04

New changeset ff59b0f9e142 by R David Murray in branch '2.7':
#13096: Fix segfault in CTypes POINTER handling of large values.
https://hg.python.org/cpython/rev/ff59b0f9e142

Committed.

It seems the python2 backport was incomplete as a PyMem_Free is missing, making buf leak.

New changeset 710dcfd2f4bee034894a39026388f9c21ea976f1 by Victor Stinner (stratakis) in branch '2.7':
[2.7] bpo-13096: Fix memory leak in ctypes POINTER handling of large values (GH-12100)
https://github.com/python/cpython/commit/710dcfd2f4bee034894a39026388f9c21ea976f1

versions: + Python 3.4
nosy: + r.david.murray

messages: + msg229187
resolution: fixed
stage: commit review -> resolved

messages: + msg217341

keywords: + needs review
stage: patch review -> commit review

stage: needs patch -> patch review