tree e729027b40a925e5c45348dde6a672cd8d72c7b9
parent a647cddd4e9f44c033eeb1d423e1bf86c6c198c1
author Henry Schreiner <HenrySchreinerIII@gmail.com> 1785290016 -0400
committer GitHub <noreply@github.com> 1785290016 -0700
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJqaV0gCRC1aQ7uu5UhlAAAJtsQAJWe6ibhPePVBiN6gVrGXPvD
 Mx4tekQq3djjcvHV15lwgWWPg/RPsvRA+WDrkPk4tWTM0FJxCGIQCWp/VO5c33sn
 a0ag0SWamWhiryC4JTw/IfMpWzvucrhedFpLZlgGn1YdLpv1zcjNWW1m3dYjWn8c
 7ZfpG14m79v5F/51xdK3+yZcJF4taLYQ2oz6qxUTJYFnAoDQqO2KYfhUEVC9HMGb
 quWRNdDvk5X7YgcwrDkpHSDtR/6/D1NOkWF1P0xMmWZHA5p1edfCa9HhH1Z6tUzP
 dhaaFejASN1bS9J4k8qSC8uNp9361R4xpCRShmkhoSP5weNPsbnfZ6QaFRCkNQE1
 HwEoS9ufjCjagYBfbmoZps7A3MnMAGNKw97mzdJsk375WhmefDc6drJFR4NggWTh
 mnu6EwjikMGHiiyUXLZNrX+Au9lySMecwRVIfNGoRvBPV61f1DcF7tJ83+kdKDWJ
 zmMGIdw3XWcExeVyoaPT7pXMZBmO6m3iHVKssv488M+bVJfCXXt6hQQIsyhQh4+b
 5biK97Cw0llACpIICFG5EZ0hMkYVNrQ86mDdafZfcBe5ykzOyp+l80oe6jsqJBKR
 5zPO8PwSMhUkbbpRw19hn9UDv2JaxwWqcykPmSiYXPRhPGlB2tsp3UWwt459LcBL
 yxqVCHN69vZd5GKMXoNJ
 =DHFM
 -----END PGP SIGNATURE-----
 

fix: only add string_view life support for transient sources (#6096)

* revert: "revert: add life support to handles cast to string_view (#6092)"

This re-applies #6092 (reverting #6097) so the follow-up fixes in this PR can build on it.

Assisted-by: ClaudeCode:claude-opus-4.8

* fix: don't throw from string_view life support outside a bound function

PR #6092 added loader_life_support::add_patient(src) to keep the source
object alive when loading a string view, fixing a real use-after-free when
a container of views is built from a non-sequence iterable (e.g. a
generator): list_caster materializes a temporary tuple that owns the
strings and destroys it when load() returns, before the bound function
body runs.

add_patient throws when there is no life support frame, so casting to a
view outside a bound function (e.g. a manual py::cast<std::string_view>)
now raises instead of relying on the caller-owned source, a regression
from #6092.

For these view-into-src cases registration is best effort: inside a bound
function it keeps src alive (fixing the UAF), and outside one the caller
owns src's lifetime as before. Add try_add_patient(), which returns false
instead of throwing when there is no frame, and use it at the three view
load sites. add_patient() keeps its strict contract for value-creating
conversions.

Assisted-by: ClaudeCode:claude-opus-4.8

* fix: only add string_view life support for transient sources

Refine the previous commit. Best-effort registration (try_add_patient)
silently produces a dangling view when a container of views is built from
a generator outside a bound function: there the materialized temporary is
released before the view is used, and with no frame nothing keeps it
alive. Such a cast cannot be made safe, so it should fail loudly, while a
view into a durable, caller-owned object needs no life support at all.

The view caster cannot tell a durable source from a pybind11-managed
transient one; that provenance lives in the container caster. Introduce an
ambient transient_source_guard that the list, set, map, and array casters
set around their generator/materialized paths, and have the string caster
keep the source alive only when loading from a transient source (via the
throwing add_patient, so try_add_patient is no longer needed). This means:

- views into durable sources (direct arguments, sequences, manual casts)
  add no life support and no longer throw outside a bound function, and
- a generator used outside a frame throws, rather than silently dangling.

The guard restores (rather than clears) the previous value, so a durable
container nested in a transient one is correctly treated as transient.

Verified with AddressSanitizer: the in-frame generator case is clean, the
out-of-frame durable cases succeed, and the out-of-frame generator case
throws.

Assisted-by: ClaudeCode:claude-opus-4.8

* Revert "fix: only add string_view life support for transient sources"

This reverts commit e18b8346a28c125964fcb9d192e6643d5ef3b420.

* test: cover string_view argument life support

* test: cover generated and nested string_view lifetimes

* test: cover temporary-backed string_view casts

* test: explain string_view lifetime regression tests

* docs: clarify string_view lifetime requirements

* docs: explain life support for custom view casters

---------

Co-authored-by: Ralf W. Grosse-Kunstleve <rgrossekunst@nvidia.com>