[New-bugs-announce] [issue9758] ioctl mutable buffer copying problem

Grzegorz Kulewski report at bugs.python.org
Fri Sep 3 18:54:12 CEST 2010

New submission from Grzegorz Kulewski <grzegorz at kulewski.pl>:


It looks like something is broken in ioctl in 3.2 when the supplied (mutable) bytearray is exactly 1024 bytes long - the result is not copied into the buffer after the ioctl succedes:

def open_tuntap(type, name):
        TUN_TYPE = {
                'TUN' : 0x0001,
                'TAP' : 0x0002

        TUNSETIFF = 0x400454ca

        dev = os.open('/dev/net/tun', os.O_RDWR)
        buf = bytearray(SET_LEN_HERE)
        name = name[:16]
        buf[:len(name)] = name
        buf[16:18] = TUN_TYPE[type].to_bytes(2, sys.byteorder)
        fcntl.ioctl(dev, TUNSETIFF, buf, True)

open_tuntap('TAP', b'madtun%d')

Now try it with SET_LEN_HERE = 1024, 1023, 1025 and any other values. For < 1024 it copies to the static buffer and back, for > 1024 it operates on the buffer itself (hopefully) and for 1024 it ignores the modified buffer completely. It's probably some corner case bug.

The example was tested under Linux 2.6.35.

Python 3.2a1+ (py3k:84054, Sep  3 2010, 01:45:35) 
[GCC 4.4.2] on linux2

components: Library (Lib)
messages: 115467
nosy: gkulewski
priority: normal
severity: normal
status: open
title: ioctl mutable buffer copying problem
type: behavior
versions: Python 3.2

Python tracker <report at bugs.python.org>

More information about the New-bugs-announce mailing list