Commit e69b349
Fix UB: memcpy requires valid pointers even with count=0 (#1198)
* Fix UB: memcpy requires valid pointers even with count=0
ASAN detected undefined behavior in nb_bound_method_vectorcall where
memcpy was called with a potentially NULL args_in pointer.
Root Cause:
Per C standard section 7.24.1 paragraph 2, pointer arguments to memcpy
must have valid values even when copying zero bytes. NULL is not a valid
pointer value.
When args_in can be NULL:
According to Python vectorcall protocol PEP 590, when a bound method is
called with zero positional arguments, the args_in pointer may be NULL.
This is valid Python behavior - Python does not allocate an array when
there are no arguments to pass.
Why the guard checks size > 1:
The code calculates size = nargs + 1 for the implicit self argument,
then copies size - 1 elements from args_in. When nargs = 0:
- size = 1
- We attempt to copy size - 1 = 0 elements
- Even though copying 0 bytes, calling memcpy with NULL violates C standard
Fix:
Guard the memcpy to only execute when there are actual arguments to copy,
i.e., when size > 1 and args_in is not NULL.
This resolves ASAN failures in projects using batch array operations with
nanobind bindings, where methods are frequently called with no arguments.
* Remove redundant NULL check per code review1 parent ab3456f commit e69b349
1 file changed
+2
-1
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1096 | 1096 | | |
1097 | 1097 | | |
1098 | 1098 | | |
1099 | | - | |
| 1099 | + | |
| 1100 | + | |
1100 | 1101 | | |
1101 | 1102 | | |
1102 | 1103 | | |
| |||
0 commit comments