Bugfixes part 3 #209

The float FFT plan generator wrote 8 ints per entry (indices +0..+7)
but declared entrysize=4, causing heap overwrite into the next entry
and incorrect plan array sizing.

fix(PISharedMemory): reset data and unlink on mmap failure ef8fdb30f4

When mmap() returned MAP_FAILED, data stayed as (void*)-1, causing
subsequent read/write/close to pass the null guard and crash.
Now resets data=nullptr, and calls shm_unlink when owner=true to
avoid orphaned shared memory objects.

fix(PIVariant): add missing break in setValueFromString switch c3cd9496dd

Three complex type cases (pivComplexf, pivComplexd, pivComplexld)
lacked break statements, causing fallthrough to pivTime. Setting
a complex variant from string silently overwrote the value with
PITime::fromString(), corrupting the variant's type and data.

fix(PIBitArray): guard pop_back() against empty array 3e72f4e533

pop_back() called resize(size_ - 1) without checking for empty.
On empty array, uint underflow produced UINT_MAX, causing
bytesInBits(UINT_MAX) overflow and subsequent OOB access.
pop_front() already had this guard; pop_back() was missing it.

fix(PIDir): initialize list pointer and check scandir return 4d9cd20ac5

dirent** list was uninitialized, so scandir failure (returning -1)
left it with indeterminate value. The unconditional free(list) at
the end was then UB — typically heap corruption or crash.

fix(PIConditionVariable): clamp negative timeout in waitFor 31ae52623d

When elapsed time exceeded the timeout, the remaining milliseconds
expression went negative and was implicitly converted to DWORD,
wrapping to ~0xFFFFFFFF (5 days) — effectively INFINITE.
Now clamps to 0 and returns false when time has elapsed.

fix(PIThread): remove spurious unlock() in _waitForFinish 5e4a55cc0c

The function called unlock() on thread_mutex without a matching
lock(), causing UB on Windows (releasing an unowned critical
section) or silently dropping a user-held lock.

fix(PIByteArray): prevent OOB in fromBase64 with non-multiple-of-4 input 1aa6f1af81

The buffer was sized as floor(sz/4)*3 but the loop ran ceil(sz/4)
times, writing 3 bytes per iteration. For sz%4!=0, this wrote past
the buffer end. Also guarded sz<4 to avoid processing trivially
short or malformed input.

fix(PISPI): close fd on ioctl error paths c8ad8ecaf4

Three ioctl calls after successful open() returned false without
closing the file descriptor, leaking one fd per failed open attempt.

fix(PISerial): close fd when probe read fails in availableDevicesInfo 9e280ef976

When the non-blocking probe read returned EIO, the loop continued
without closing the file descriptor, leaking one fd per rejected
port on each call.

fix(PISystemInfo): correct guard for df output parsing 1a153eefbc

The guard ml.size_s() < 2 allowed size==2, but ml[2] was then
accessed — OOB read on truncated or unusual df output lines.

andrey force-pushed bugfixes3 from 9831812839 to 1a153eefbc

2026-08-06 17:01:33 +03:00

Compare

peri4 marked the pull request as ready for review 2026-08-06 21:05:54 +03:00

peri4 marked the pull request as work in progress 2026-08-06 21:06:16 +03:00

andrey added 2 commits 2026-08-10 14:59:24 +03:00

Revert "fix: PISingleApplication TOCTOU — two shm reads replaced with single atomic read" fc2e49b096

This reverts commit 1b23a258b8.

Revert "fix(PIFFT_float): correct plan entry size from 4 to 8" f9a846a3e9

This reverts commit 2bb3884aee.

andrey marked the pull request as ready for review 2026-08-10 14:59:58 +03:00

andrey added 4 commits 2026-08-10 15:49:06 +03:00

fix(picloudserver): use piMin<ssize_t> to avoid signed/unsigned UB in Client::readDevice 1c9cdbba19

piMini(max_size, buff.size()) implicitly narrows size_t to int,
which is UB for large buffers. Replace with explicit piMin<ssize_t>
matching the correct pattern used in picloudclient.cpp.

fix(pibasetransfer): make shared flags std::atomic<bool> to eliminate data race b180d91b1e

Flags break_, is_sending, is_receiving, is_pause are accessed from
both the send thread (send_process) and the read thread (received)
without synchronization. Plain bool reads/writes from multiple threads
is undefined behavior per C++ standard. Convert to std::atomic<bool>
with proper initializers.

fix(piconnection): prevent UAF in DevicePool::run() during connection deletion c3bdc5464e

The background run() thread copies allConnections() then iterates
each connection's diags_ map. If a PIConnection is deleted from
another thread between the copy and the iteration, dereferencing
the pointer is UAF. Add null check and protect diags_ iteration
with __device_pool__ lock.

fix(pibasetransfer): fix ABBA deadlock — enforce consistent mutex lock ordering aa64eb4c7f

received() acquired mutex_header and mutex_session in different orders
depending on packet type:
  - pt_Data path:  mutex_header → mutex_session
  - pt_Start path: mutex_session → mutex_header

send_process() acquires mutex_session independently. When running
concurrently with received(), the reversed lock ordering creates a
classic ABBA deadlock scenario.

Fix: enforce consistent ordering (mutex_header → mutex_session) in
all code paths. Restructured pt_Start case and buildSession() to
always acquire mutex_header before mutex_session.

andrey added 6 commits 2026-08-10 16:43:38 +03:00

fix(picompress): pass correct source size to uncompress() 16adea05af

piDecompress() appended original size as 8-byte ullong at the end
of compressed data, but passed zba.size() (including the 8 bytes)
to uncompress(). This fed trailing metadata as part of the zlib
stream. Fix: subtract sizeof(ullong) from source length.

fix(picrypt): use crypto_box_* constants for public-key decrypt 9294cd7b7b

The decrypt() function for crypto_box (public-key) used
crypto_secretbox_NONCEBYTES and crypto_secretbox_MACBYTES
(secret-key constants) instead of crypto_box_* constants.
These happen to be equal in libsodium but are semantically
different APIs. Fix ensures consistency with the encrypt()
counterpart.

fix(piluaprogram): add destructor to close Lua state 4d2c268710

luaL_newstate() allocates a Lua state (~2-4 MB with libraries)
in the constructor, but there was no destructor to call lua_close().
Every PILuaProgram instance leaked its entire Lua state.
Add ~PILuaProgram() that calls lua_close(PRIVATE->lua_state).

fix(piopencl): release context on command queue creation failure 9a4384a378

If clCreateContext succeeded but clCreateCommandQueue failed,
the context handle was returned without being released, leaking
the OpenCL context and all associated GPU resources.

fix(curl_thread_pool): clean up clients_in_proc in destroy() 69673ff7c6

destroy() aborted and deleted clients in the queue but did not
delete clients that were currently being processed (clients_in_proc).
If a thread was terminated while processing a client, that client
object and its CURL handle were leaked.

fix(piusb): fix 4 bugs in USB read/write/enumeration/close ace5960e70

1. Missing break in readDevice() Bulk case: Bulk read result was
   overwritten by interrupt read, silently corrupting all bulk reads.

2. Wrong variable in writeDevice(): switch checked ep_read instead
   of ep_write; Interrupt case used ep_read.address for writes.

3. Interface mismatch in closeDevice(): always released interface 0
   (intefrace_) instead of the actually claimed interface
   (interface_claimed), leaking non-zero interface claims.

4. Wrong index in interface enumeration: used outer loop variable c
   (configuration index) instead of i (interface index), reading
   wrong interface descriptors or causing OOB access.

andrey added 1 commit 2026-08-10 21:39:46 +03:00

Reapply "fix: PISingleApplication TOCTOU — two shm reads replaced with single atomic read" c8f6fe7641

This reverts commit fc2e49b096.

andrey added 1 commit 2026-08-11 11:15:58 +03:00

version f2d692725a

andrey merged commit a81a450c44 into master

2026-08-11 11:16:56 +03:00

andrey deleted branch bugfixes3

2026-08-11 11:16:56 +03:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: SHS/pip#209