[Bf-committers] bpy.Image memoryview problems

[Campbell Barton]

On Wed, May 5, 2010 at 3:59 AM, Dan Eicher <dan at trollwerks.org> wrote:
> On Tue, May 4, 2010 at 2:06 AM, Theo de Ridder <theo.de.ridder at planet.nl>wrote:
>
>>
>> On 4 mei 2010, at 08:13, Campbell wrote:
>>
>> > class Image(bpy_types.ID):
>> >    def buffer_get(self, type="byte", frame=None):
>> >        return None # replace with ctypes/buffer stuff.
>> >
>> > After this you can do..
>> >  buffer = bpy.data.images["foo"].buffer_get()
>>
>> I tried this, by adding those lines in the bpy_types.py module within
>> the blender2.5a2 on OSX, but 'buffer_get' remained an unknown attribute,
>> also 'as_pointer' was unknown.
>> and when it works is it possible to find the needed info for ctypes through
>> introspection, or do you need to search for the structure layouts in de
>> sources?
>>
>> ~Theo
>>
>
> I'm not quite sure it will work out as planned since the python docs say
> "Capsules can only be created and accessed via their C API, but they can be
> passed around like any other Python object."
>
> Not too clear on how to use ctypes to get at the internal struct and
> functions of the running binary either.
>
> Also seems a bit silly to be talking about adding a recursive-decent parser
> to py-constrants/drivers for 'security' but then exporting a raw pointer
> into script space (assuming you can get at it through python) where the
> wrapped void* could be turned into anything and used for whatever evil
> purposes the script writer wants. Not that I actually care about all the
> security theater going on but it is a valid point.
>
> Oh, and the as_pointer() method does work here.

indeed it seems there is no way to get a PyCapsule into ctypes.
Since this was the purpose, as_pointer() could return an 'int' which
ctypes can convert into a pointer.

as for security, there are probably easier ways to exploit blender
then getting a pointer to an image and somehow replacing parts of it
with machine code???.

struct.as_pointer() could be rewritten in ctypes alone by getting the
PyObject pointer the the pointer to the ID from that (which always has
the same offset), in fact even without any api access, a developer
with ctypes can write into any part of blenders memory they like.

-- 
- Campbell