Describe the bug
PyMOL can corrupt the heap when a wizard/message list contains non-ASCII text. This can later surface as a segmentation fault while refreshing a wizard, recalling a scene, or loading/using a saved session.
This appears to be a byte-length versus Unicode-code-point-length bug in PConvPyListToStringVLA.
Reproduction context
A session containing a scene/wizard message such as:
message = "Unicode test: 测试消息"
can trigger the problem when the message wizard is restored/refreshed. Saving the same session with an ASCII-only message avoids the crash. Removing only the saved wizard state also avoids it.
Observed behavior
On macOS ARM64 with a Python 3.10 PyMOL build, the process terminates with EXC_BAD_ACCESS / SIGSEGV. With malloc diagnostics enabled, heap corruption is detected. Symbolicated observations include WizardRefresh; later failures can occur in unrelated-looking functions because the heap has already been overwritten.
Expected behavior
Non-ASCII wizard and scene messages should be handled safely as UTF-8 and survive session save/load.
Suspected root cause
In Python 3, PyString_Size is mapped to PyUnicode_GetLength, which returns the number of Unicode code points:
https://github.com/schrodinger/pymol-open-source/blob/master/layer0/os_python.h#L46-L52
PConvPyListToStringVLA uses that value to size and advance a char buffer, but copies the UTF-8 result returned by PyString_AsSomeString:
https://github.com/schrodinger/pymol-open-source/blob/master/layer1/PConv.cpp#L1150-L1177
For example, a CJK string has more UTF-8 bytes than Unicode code points. The allocation/offset is therefore too small, and the copy writes beyond the VLA.
The affected conversion is used while refreshing wizard panels here:
https://github.com/schrodinger/pymol-open-source/blob/master/layer1/Wizard.cpp#L195-L211
Workaround
Use ASCII-only text for wizard/scene messages, or remove the saved wizard before saving the session.
Describe the bug
PyMOL can corrupt the heap when a wizard/message list contains non-ASCII text. This can later surface as a segmentation fault while refreshing a wizard, recalling a scene, or loading/using a saved session.
This appears to be a byte-length versus Unicode-code-point-length bug in
PConvPyListToStringVLA.Reproduction context
A session containing a scene/wizard message such as:
can trigger the problem when the message wizard is restored/refreshed. Saving the same session with an ASCII-only message avoids the crash. Removing only the saved wizard state also avoids it.
Observed behavior
On macOS ARM64 with a Python 3.10 PyMOL build, the process terminates with
EXC_BAD_ACCESS / SIGSEGV. With malloc diagnostics enabled, heap corruption is detected. Symbolicated observations includeWizardRefresh; later failures can occur in unrelated-looking functions because the heap has already been overwritten.Expected behavior
Non-ASCII wizard and scene messages should be handled safely as UTF-8 and survive session save/load.
Suspected root cause
In Python 3,
PyString_Sizeis mapped toPyUnicode_GetLength, which returns the number of Unicode code points:https://github.com/schrodinger/pymol-open-source/blob/master/layer0/os_python.h#L46-L52
PConvPyListToStringVLAuses that value to size and advance acharbuffer, but copies the UTF-8 result returned byPyString_AsSomeString:https://github.com/schrodinger/pymol-open-source/blob/master/layer1/PConv.cpp#L1150-L1177
For example, a CJK string has more UTF-8 bytes than Unicode code points. The allocation/offset is therefore too small, and the copy writes beyond the VLA.
The affected conversion is used while refreshing wizard panels here:
https://github.com/schrodinger/pymol-open-source/blob/master/layer1/Wizard.cpp#L195-L211
Workaround
Use ASCII-only text for wizard/scene messages, or remove the saved wizard before saving the session.