gh-143005: prevent incompatible __class__ reassignment for ctypes arrays

[VanshAgarwal24036]

This PR fixes a heap buffer overflow in ctypes arrays caused by assigning
class to an incompatible array type.

The change rejects class reassignment when the new array type differs
in length, size, or element type, preventing out-of-bounds memory access.
A regression test is included.

• Issue: Heap buffer overflow in ctypes array assignment via __class__ swap #143005

[VanshAgarwal24036]

@serhiy-storchaka
I’ve opened a PR fixing the ctypes array class reassignment issue discussed here.
CI is green now; no rush, just sharing in case you have time to take a look.

[serhiy-storchaka]

Thank you for your PR, @VanshAgarwal24036. I did not know what to do with this issue. It seems that adding check in tp_setattro is the way to go. But I suspect we need more tests -- each condition should be covered by alternate tests,

[picnixz]

What if we simply expose __class__ as a getset? isn't it possible?

[serhiy-storchaka]

There are problems with such special names. If we expose __class__ as a getset, then c_long.__class__ will be not a type of c_long (the same as type(c_long)), but a descriptor. This will confuse much code.

[picnixz]

Arf yes you are right. It just feels to me that it is an overkill but I do not think we have a better alternative, do we?

[VanshAgarwal24036]

Thanks for the discussion

I agree exposing __class__ as getset would be problematic since it would turn
type(obj).__class__ into descriptor and break expectations.

Given that validating reassignment in tp_setattro seems like least disruptive
approach. I will follow up with additional tests to cover the remaining edge cases
(abstract targets, non-array targets, zero-length arrays, etc.) if you suggest.