Segfault in _invoke_marshal_out_args due to incorrect child argument count
When trying to call libvte's "event_check_regex_simple" function, _invoke_marshal_out_args()
segfaults. This function reuses the same length argument for both input and output arguments, here's the signature:
* @terminal: a #VteTerminal
* @event: a #GdkEvent
* @regexes: (array length=n_regexes): an array of #VteRegex
* @n_regexes: number of items in @regexes
* @match_flags: PCRE2 match flags, or 0
* @matches: (out caller-allocates) (array length=n_regexes): a location to store the matches
gboolean
vte_terminal_event_check_regex_simple(VteTerminal *terminal,
GdkEvent *event,
VteRegex **regexes,
gsize n_regexes,
guint32 match_flags,
char **matches)
_invoke_marshal_out_args()
tries to dereference a null pointer when looping over the argument list.
I've tried to debug the issue. I saw that tuple_len
was bigger than it should, then I figured out that the cause was that cache->n_to_py_child_args
was 0, while it should be 1 since that function did have an array length as an output argument.
I found that that value is normally incremented in pygi_arg_garray_len_arg_setup()
, but there I also saw an early return in case the argument cache was already initialized. Since this is the case for "event_check_regex_simple" which reuses the length argument, this function returns before incrementing n_to_py_child_args
, which in turn causes the marshaller to segfault.