BUG: Hang on to originally filled Py_Buffer view.

When filling the python buffer view object, python sets
view.shape = &view.len (ndim=1, so this works). If we copy
the view info into our Memoryview object instead of having
it directly filled &view.len points into nirvana.

Closes gh-3175

1 files changed, 8 insertions, 7 deletions

diff --git a/numpy/core/src/multiarray/numpymemoryview.c b/numpy/core/src/multiarray/numpymemoryview.c
index 27c02e592..ccc5f33ed 100644
--- a/numpy/core/src/multiarray/numpymemoryview.c
+++ b/numpy/core/src/multiarray/numpymemoryview.c
@@ -252,7 +252,6 @@ NPY_NO_EXPORT PyObject *
 PyMemorySimpleView_FromObject(PyObject *base)
 {
     PyMemorySimpleViewObject *mview = NULL;
-    Py_buffer view;
 
     if (Py_TYPE(base)->tp_as_buffer == NULL ||
         Py_TYPE(base)->tp_as_buffer->bf_getbuffer == NULL) {
@@ -263,17 +262,19 @@ PyMemorySimpleView_FromObject(PyObject *base)
         return NULL;
     }
 
-    memset(&view, 0, sizeof(Py_buffer));
-    if (PyObject_GetBuffer(base, &view, PyBUF_FULL_RO) < 0)
-        return NULL;
-
     mview = (PyMemorySimpleViewObject *)
         PyObject_GC_New(PyMemorySimpleViewObject, &PyMemorySimpleView_Type);
     if (mview == NULL) {
-        PyBuffer_Release(&view);
         return NULL;
     }
-    memcpy(&mview->view, &view, sizeof(Py_buffer));
+
+    memset(&mview->view, 0, sizeof(Py_buffer));
+    mview->base = NULL;
+    if (PyObject_GetBuffer(base, &mview->view, PyBUF_FULL_RO) < 0) {
+        Py_DECREF(mview);
+        return NULL;
+    }
+
     mview->base = base;
     Py_INCREF(base);