Bugfixes part 3 #209

The float FFT plan generator wrote 8 ints per entry (indices +0..+7)
but declared entrysize=4, causing heap overwrite into the next entry
and incorrect plan array sizing.

fix(PISharedMemory): reset data and unlink on mmap failure ef8fdb30f4

When mmap() returned MAP_FAILED, data stayed as (void*)-1, causing
subsequent read/write/close to pass the null guard and crash.
Now resets data=nullptr, and calls shm_unlink when owner=true to
avoid orphaned shared memory objects.

fix(PIVariant): add missing break in setValueFromString switch c3cd9496dd

Three complex type cases (pivComplexf, pivComplexd, pivComplexld)
lacked break statements, causing fallthrough to pivTime. Setting
a complex variant from string silently overwrote the value with
PITime::fromString(), corrupting the variant's type and data.

fix(PIBitArray): guard pop_back() against empty array 3e72f4e533

pop_back() called resize(size_ - 1) without checking for empty.
On empty array, uint underflow produced UINT_MAX, causing
bytesInBits(UINT_MAX) overflow and subsequent OOB access.
pop_front() already had this guard; pop_back() was missing it.

fix(PIDir): initialize list pointer and check scandir return 4d9cd20ac5

dirent** list was uninitialized, so scandir failure (returning -1)
left it with indeterminate value. The unconditional free(list) at
the end was then UB — typically heap corruption or crash.

fix(PIConditionVariable): clamp negative timeout in waitFor 31ae52623d

When elapsed time exceeded the timeout, the remaining milliseconds
expression went negative and was implicitly converted to DWORD,
wrapping to ~0xFFFFFFFF (5 days) — effectively INFINITE.
Now clamps to 0 and returns false when time has elapsed.

fix(PIThread): remove spurious unlock() in _waitForFinish 5e4a55cc0c

The function called unlock() on thread_mutex without a matching
lock(), causing UB on Windows (releasing an unowned critical
section) or silently dropping a user-held lock.

fix(PIByteArray): prevent OOB in fromBase64 with non-multiple-of-4 input 1aa6f1af81

The buffer was sized as floor(sz/4)*3 but the loop ran ceil(sz/4)
times, writing 3 bytes per iteration. For sz%4!=0, this wrote past
the buffer end. Also guarded sz<4 to avoid processing trivially
short or malformed input.

fix(PISPI): close fd on ioctl error paths c8ad8ecaf4

Three ioctl calls after successful open() returned false without
closing the file descriptor, leaking one fd per failed open attempt.

fix(PISerial): close fd when probe read fails in availableDevicesInfo 9e280ef976

When the non-blocking probe read returned EIO, the loop continued
without closing the file descriptor, leaking one fd per rejected
port on each call.

fix(PISystemInfo): correct guard for df output parsing 1a153eefbc

The guard ml.size_s() < 2 allowed size==2, but ml[2] was then
accessed — OOB read on truncated or unusual df output lines.

andrey force-pushed bugfixes3 from 9831812839 to 1a153eefbc

2026-08-06 17:01:33 +03:00

Compare

peri4 marked the pull request as ready for review 2026-08-06 21:05:54 +03:00

peri4 marked the pull request as work in progress 2026-08-06 21:06:16 +03:00

andrey added 2 commits 2026-08-10 14:59:24 +03:00

Revert "fix: PISingleApplication TOCTOU — two shm reads replaced with single atomic read" fc2e49b096

This reverts commit 1b23a258b8.

Revert "fix(PIFFT_float): correct plan entry size from 4 to 8" f9a846a3e9

This reverts commit 2bb3884aee.

andrey marked the pull request as ready for review 2026-08-10 14:59:58 +03:00

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin bugfixes3:bugfixes3

git checkout bugfixes3

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: SHS/pip#209