[ python-Bugs-950274 ] buffer() can point to freed memory

[SourceForge.net]

Bugs item #950274, was opened at 2004-05-08 04:02
Message generated for change (Comment added) made by nascheme
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=950274&group_id=5470

Category: Python Interpreter Core
Group: Python 2.3
>Status: Closed
>Resolution: Invalid
Priority: 5
Submitted By: L. Peter Deutsch (lpd)
>Assigned to: Neil Schemenauer (nascheme)
Summary: buffer() can point to freed memory

Initial Comment:
This is related to the issue in bug 216405, but
different enough that I think it needs consideration.

Sample code:

import array
t = array.array('b', 100 * 'x')
u = buffer(t, 0, 100)
del t[:]
print u[:]

You'll probably get something that is *not* 100 x's,
because the buffer will point to (partly) deallocated
storage.

This problem can arise with any buffer if the object it
references can change length.  Buffers currently refuse
to reference lists, but they don't refuse arrays.

Frankly, I don't know what to recommend here. I was
surprised when I found out that arrays can change
length: my first suggestion is to remove this
capability. If this isn't acceptable, I don't know what
to suggest next.


----------------------------------------------------------------------

>Comment By: Neil Schemenauer (nascheme)
Date: 2004-05-08 16:58

Message:
Logged In: YES 
user_id=35752

This problem has been fixed in the CVS version of Python for
a while now.  buffer objects no longer store pointers to
memory but use the buffer API to get fresh ones whenever
they are needed.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=950274&group_id=5470