fix UB in to_npy_dims

Author: davidhewitt

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 - v0.17.1
   - Fix use-after-free in `PyArray::resize`, `PyArray::reshape` and `PyArray::reshape_with_order`. ([#341](https://github.com/PyO3/rust-numpy/pull/341))
+  - Fix UB in `ToNpyDims::as_dims_ptr` with dimensions of dynamic size (-1). ([#344](https://github.com/PyO3/rust-numpy/pull/344))
 
 - v0.17.0
   - Add dynamic borrow checking to safely construct references into the interior of NumPy arrays. ([#274](https://github.com/PyO3/rust-numpy/pull/274))

src/array.rs

@@ -464,7 +464,7 @@ impl<T: Element, D: Dimension> PyArray<T, D> {
     where
         ID: IntoDimension<Dim = D>,
     {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         let ptr = PY_ARRAY_API.PyArray_NewFromDescr(
             py,
             PY_ARRAY_API.get_type_object(py, npyffi::NpyTypes::PyArray_Type),
@@ -490,7 +490,7 @@ impl<T: Element, D: Dimension> PyArray<T, D> {
     where
         ID: IntoDimension<Dim = D>,
     {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         let ptr = PY_ARRAY_API.PyArray_NewFromDescr(
             py,
             PY_ARRAY_API.get_type_object(py, npyffi::NpyTypes::PyArray_Type),
@@ -612,7 +612,7 @@ impl<T: Element, D: Dimension> PyArray<T, D> {
     where
         ID: IntoDimension<Dim = D>,
     {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         unsafe {
             let ptr = PY_ARRAY_API.PyArray_Zeros(
                 py,
@@ -1379,7 +1379,7 @@ impl<T: Element, D> PyArray<T, D> {
         dims: ID,
         order: NPY_ORDER,
     ) -> PyResult<&'py PyArray<T, ID::Dim>> {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         let mut dims = dims.to_npy_dims();
         let ptr = unsafe {
             PY_ARRAY_API.PyArray_Newshape(
@@ -1437,7 +1437,7 @@ impl<T: Element, D> PyArray<T, D> {
     /// [ndarray-resize]: https://numpy.org/doc/stable/reference/generated/numpy.ndarray.resize.html
     /// [PyArray_Resize]: https://numpy.org/doc/stable/reference/c-api/array.html#c.PyArray_Resize
     pub unsafe fn resize<ID: IntoDimension>(&self, dims: ID) -> PyResult<()> {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         let mut dims = dims.to_npy_dims();
         let res = PY_ARRAY_API.PyArray_Resize(
             self.py(),

src/convert.rs

@@ -213,11 +213,11 @@ pub trait ToNpyDims: Dimension + Sealed {
         self.ndim() as c_int
     }
     #[doc(hidden)]
-    fn as_dims_ptr(&self) -> *mut npyffi::npy_intp {
-        self.slice().as_ptr() as *mut npyffi::npy_intp
+    fn as_dims_ptr(&mut self) -> *mut npyffi::npy_intp {
+        self.slice_mut().as_ptr() as *mut npyffi::npy_intp
     }
     #[doc(hidden)]
-    fn to_npy_dims(&self) -> npyffi::PyArray_Dims {
+    fn to_npy_dims(&mut self) -> npyffi::PyArray_Dims {
         npyffi::PyArray_Dims {
             ptr: self.as_dims_ptr(),
             len: self.ndim_cint(),