Skip to content

Heap buffer overflow in PConvPyListToStringVLA with non-ASCII wizard messages #517

Description

@AkiraLan

Describe the bug

PyMOL can corrupt the heap when a wizard/message list contains non-ASCII text. This can later surface as a segmentation fault while refreshing a wizard, recalling a scene, or loading/using a saved session.

This appears to be a byte-length versus Unicode-code-point-length bug in PConvPyListToStringVLA.

Reproduction context

A session containing a scene/wizard message such as:

message = "Unicode test: 测试消息"

can trigger the problem when the message wizard is restored/refreshed. Saving the same session with an ASCII-only message avoids the crash. Removing only the saved wizard state also avoids it.

Observed behavior

On macOS ARM64 with a Python 3.10 PyMOL build, the process terminates with EXC_BAD_ACCESS / SIGSEGV. With malloc diagnostics enabled, heap corruption is detected. Symbolicated observations include WizardRefresh; later failures can occur in unrelated-looking functions because the heap has already been overwritten.

Expected behavior

Non-ASCII wizard and scene messages should be handled safely as UTF-8 and survive session save/load.

Suspected root cause

In Python 3, PyString_Size is mapped to PyUnicode_GetLength, which returns the number of Unicode code points:

https://github.com/schrodinger/pymol-open-source/blob/master/layer0/os_python.h#L46-L52

PConvPyListToStringVLA uses that value to size and advance a char buffer, but copies the UTF-8 result returned by PyString_AsSomeString:

https://github.com/schrodinger/pymol-open-source/blob/master/layer1/PConv.cpp#L1150-L1177

For example, a CJK string has more UTF-8 bytes than Unicode code points. The allocation/offset is therefore too small, and the copy writes beyond the VLA.

The affected conversion is used while refreshing wizard panels here:

https://github.com/schrodinger/pymol-open-source/blob/master/layer1/Wizard.cpp#L195-L211

Workaround

Use ASCII-only text for wizard/scene messages, or remove the saved wizard before saving the session.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions