From 1e1f1f4dd6e5a4b7521c22ad269bedb6b1871fb4 Mon Sep 17 00:00:00 2001
From: David Hewitt <1939362+davidhewitt@users.noreply.github.com>
Date: Sat, 27 Aug 2022 22:00:09 +0100
Subject: [PATCH] fix UB in to_npy_dims

---
 CHANGELOG.md   |  1 +
 src/array.rs   | 10 +++++-----
 src/convert.rs |  6 +++---
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 48c02fbde..aaed3f2a9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 - v0.17.1
   - Fix use-after-free in `PyArray::resize`, `PyArray::reshape` and `PyArray::reshape_with_order`. ([#341](https://github.com/PyO3/rust-numpy/pull/341))
+  - Fix UB in `ToNpyDims::as_dims_ptr` with dimensions of dynamic size (-1). ([#344](https://github.com/PyO3/rust-numpy/pull/344))
 
 - v0.17.0
   - Add dynamic borrow checking to safely construct references into the interior of NumPy arrays. ([#274](https://github.com/PyO3/rust-numpy/pull/274))
diff --git a/src/array.rs b/src/array.rs
index 83023d0e6..f42b2e161 100644
--- a/src/array.rs
+++ b/src/array.rs
@@ -464,7 +464,7 @@ impl<T: Element, D: Dimension> PyArray<T, D> {
     where
         ID: IntoDimension<Dim = D>,
     {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         let ptr = PY_ARRAY_API.PyArray_NewFromDescr(
             py,
             PY_ARRAY_API.get_type_object(py, npyffi::NpyTypes::PyArray_Type),
@@ -490,7 +490,7 @@ impl<T: Element, D: Dimension> PyArray<T, D> {
     where
         ID: IntoDimension<Dim = D>,
     {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         let ptr = PY_ARRAY_API.PyArray_NewFromDescr(
             py,
             PY_ARRAY_API.get_type_object(py, npyffi::NpyTypes::PyArray_Type),
@@ -612,7 +612,7 @@ impl<T: Element, D: Dimension> PyArray<T, D> {
     where
         ID: IntoDimension<Dim = D>,
     {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         unsafe {
             let ptr = PY_ARRAY_API.PyArray_Zeros(
                 py,
@@ -1379,7 +1379,7 @@ impl<T: Element, D> PyArray<T, D> {
         dims: ID,
         order: NPY_ORDER,
     ) -> PyResult<&'py PyArray<T, ID::Dim>> {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         let mut dims = dims.to_npy_dims();
         let ptr = unsafe {
             PY_ARRAY_API.PyArray_Newshape(
@@ -1437,7 +1437,7 @@ impl<T: Element, D> PyArray<T, D> {
     /// [ndarray-resize]: https://numpy.org/doc/stable/reference/generated/numpy.ndarray.resize.html
     /// [PyArray_Resize]: https://numpy.org/doc/stable/reference/c-api/array.html#c.PyArray_Resize
     pub unsafe fn resize<ID: IntoDimension>(&self, dims: ID) -> PyResult<()> {
-        let dims = dims.into_dimension();
+        let mut dims = dims.into_dimension();
         let mut dims = dims.to_npy_dims();
         let res = PY_ARRAY_API.PyArray_Resize(
             self.py(),
diff --git a/src/convert.rs b/src/convert.rs
index d552ea3ec..ded0cf8b2 100644
--- a/src/convert.rs
+++ b/src/convert.rs
@@ -213,11 +213,11 @@ pub trait ToNpyDims: Dimension + Sealed {
         self.ndim() as c_int
     }
     #[doc(hidden)]
-    fn as_dims_ptr(&self) -> *mut npyffi::npy_intp {
-        self.slice().as_ptr() as *mut npyffi::npy_intp
+    fn as_dims_ptr(&mut self) -> *mut npyffi::npy_intp {
+        self.slice_mut().as_ptr() as *mut npyffi::npy_intp
     }
     #[doc(hidden)]
-    fn to_npy_dims(&self) -> npyffi::PyArray_Dims {
+    fn to_npy_dims(&mut self) -> npyffi::PyArray_Dims {
         npyffi::PyArray_Dims {
             ptr: self.as_dims_ptr(),
             len: self.ndim_cint(),