Repository navigation
Conversation
libmagic reads and writes the value of magic_setparam/magic_getparam as a size_t, but magic/compat.py built a c_int buffer instead. On 64-bit that truncated values above 32 bits before they reached libmagic (and getparam let libmagic write 8 bytes into a 4-byte buffer). magic/__init__.py already uses c_size_t; only the compat layer was left behind.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
magic/compat.pybuilds actypes.c_int(4 bytes) buffer formagic_setparam/magic_getparam, but libmagic dereferences that pointer as asize_t(ms->bytes_max = *(const size_t *)valuein file's func.c):On 64-bit this has three real effects: setparam silently truncates values above 32 bits and still reports success, getparam lets libmagic write 8 bytes into a 4-byte buffer, and the write path hands libmagic 4 uninitialized adjacent bytes.
magic/__init__.pyalready usesc_size_t(it was fixed there before); only the compat layer, added later, was left withc_int.Reproduction (Python 3.11, libmagic 5.44, Linux x64)
Setting
bytes_maxto 0 breaks identification for every laterfrom_*call on that handle, so the truncation is not cosmetic.Fix
Use
c_size_tin the compatgetparam/setparam, asmagic/__init__.pyalready does.Coverage
New
test_compat_params_use_size_tin test/python_magic_test.py: sets PARAM_BYTES_MAX to 2**33 and reads it back. It fails on master (AssertionError: 8589934592 != 0) and passes with the patch. Full suites: python_magic_test 14 tests OK (2 skipped), libmagic_test 3 tests OK.(The test file requires
export LC_ALL=en_US.UTF-8, as the suite's own guard asks.)