[Twisted-Python] twisted.python.sendmsg segfault - looking for confirmation

[ex vito]

Dear all,

While working on http://twistedmatrix.com/trac/ticket/8912 and the associated PR at https://github.com/twisted/twisted/pull/647 I hit a segmentation fault on a test I was preparing.

I think narrowed it down Linux + Python 2, but I'm not 100% sure. Can anyone please confirm the  code below segfaults on such environment? For completeness, from my tests, it works fine on Linux + Python 3, and fails with socket.error/OSError on Mac OS 10.9.5 + Python 2/3. No BSDs at hand to try out...

As far as I can tell, no code in Twisted uses sendmsg in the way the code is using it. However, twisted.python.sendmsg is a public API so someone somewhere may hit this like I just did.

Other than looking for confirmation, I have a fix which I included two isolated commits in the PR. Twisted project members: if this is confirmed, maybe a ticket should be created in Trac and an independent PR created, correct?

Thanks in advance for any input.
Regards,
--
exvito

-[ cut here ]----------------------------------------------------------------------

import os
import socket
import struct
import sys

from twisted.python import sendmsg

if __name__ == '__main__':

    # This code segfaults when running with twisted/trunk commit
    # 98a3df200968b78bd3b985dfd4fb10a5b415d6fc on Linux Python 2
    # due to a bug in src/twisted/python/_sendmsg.c and glibc's
    # CMSG_NXTHDR implementation.

    # get connected sockets
    s1, s2 = socket.socketpair(socket.AF_UNIX)

    # two CMSGs in ancillary data (no segfault with just one)
    ancillary = [
        (socket.SOL_SOCKET, sendmsg.SCM_RIGHTS, struct.pack('i', s1.fileno())),
        (socket.SOL_SOCKET, sendmsg.SCM_RIGHTS, struct.pack('i', s2.fileno())),
    ]

    expected = {
        2: 'Expecting to segfault.',
        3: 'Should not segfault.',
    }
    print expected.get(sys.version_info.major, 'Unexpected Python version.')
    retval = sendmsg.sendmsg(s1, data=b'some data', ancillary=ancillary)
    print 'Did not segfault.'

-[ cut here ]----------------------------------------------------------------------