From 0273354ab64d3cf06522ddb33f7acf3de7481ccf Mon Sep 17 00:00:00 2001 From: Mark Dickinson Date: Fri, 29 Jan 2010 17:16:18 +0000 Subject: [PATCH] Merged revisions 77821 via svnmerge from svn+ssh://pythondev@svn.python.org/python/trunk ........ r77821 | mark.dickinson | 2010-01-29 17:11:39 +0000 (Fri, 29 Jan 2010) | 3 lines Issue #7788: Fix a crash produced by deleting a list slice with huge step value. Patch by Marcin Bachry. ........ --- Lib/test/list_tests.py | 3 +++ Lib/test/test_array.py | 3 +++ Lib/test/test_bytes.py | 2 +- Misc/NEWS | 3 +++ Modules/arraymodule.c | 5 +++-- Objects/bytearrayobject.c | 3 ++- Objects/listobject.c | 3 ++- 7 files changed, 17 insertions(+), 5 deletions(-) diff --git a/Lib/test/list_tests.py b/Lib/test/list_tests.py index c9aa3160a9b..8dd6de634e2 100644 --- a/Lib/test/list_tests.py +++ b/Lib/test/list_tests.py @@ -519,6 +519,9 @@ class CommonTest(seq_tests.CommonTest): a = self.type2test(range(10)) a[::2] = tuple(range(5)) self.assertEqual(a, self.type2test([0, 1, 1, 3, 2, 5, 3, 7, 4, 9])) + # test issue7788 + a = self.type2test(range(10)) + del a[9::1<<333] def test_constructor_exception_handling(self): # Bug #1242657 diff --git a/Lib/test/test_array.py b/Lib/test/test_array.py index 2c4c2fdc9f1..206042f7443 100755 --- a/Lib/test/test_array.py +++ b/Lib/test/test_array.py @@ -850,6 +850,9 @@ class NumberTest(BaseTest): a = array.array(self.typecode, range(10)) del a[::1000] self.assertEqual(a, array.array(self.typecode, [1,2,3,4,5,6,7,8,9])) + # test issue7788 + a = array.array(self.typecode, range(10)) + del a[9::1<<333] def test_assignment(self): a = array.array(self.typecode, range(10)) diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py index f8f36deef2a..85d5e0347e0 100644 --- a/Lib/test/test_bytes.py +++ b/Lib/test/test_bytes.py @@ -569,7 +569,7 @@ class ByteArrayTest(BaseBytesTest): self.assertEqual(b, bytearray([0, 1, 2, 42, 42, 42, 3, 4, 5, 6, 7, 8, 9])) def test_extended_set_del_slice(self): - indices = (0, None, 1, 3, 19, 300, -1, -2, -31, -300) + indices = (0, None, 1, 3, 19, 300, 1<<333, -1, -2, -31, -300) for start in indices: for stop in indices: # Skip invalid step 0 diff --git a/Misc/NEWS b/Misc/NEWS index d518010a39a..73267a8e2ea 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -12,6 +12,9 @@ What's New in Python 2.6.5 Core and Builtins ----------------- +- Issue #7788: Fix an interpreter crash produced by deleting a list + slice with very large step value. + - Issue #7561: Operations on empty bytearrays (such as `int(bytearray())`) could crash in many places because of the PyByteArray_AS_STRING() macro returning NULL. The macro now returns a statically allocated empty diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c index 6fad71c8a6a..3b493d50f1f 100644 --- a/Modules/arraymodule.c +++ b/Modules/arraymodule.c @@ -1794,8 +1794,9 @@ array_ass_subscr(arrayobject* self, PyObject* item, PyObject* value) } else if (needed == 0) { /* Delete slice */ - Py_ssize_t cur, i; - + size_t cur; + Py_ssize_t i; + if (step < 0) { stop = start + 1; start = stop + step * (slicelength - 1) - 1; diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c index 1b4c22a9e06..a634cff27be 100644 --- a/Objects/bytearrayobject.c +++ b/Objects/bytearrayobject.c @@ -699,7 +699,8 @@ bytes_ass_subscript(PyByteArrayObject *self, PyObject *index, PyObject *values) else { if (needed == 0) { /* Delete slice */ - Py_ssize_t cur, i; + size_t cur; + Py_ssize_t i; if (!_canresize(self)) return -1; diff --git a/Objects/listobject.c b/Objects/listobject.c index c5b14758029..843df6b0621 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -2604,7 +2604,8 @@ list_ass_subscript(PyListObject* self, PyObject* item, PyObject* value) if (value == NULL) { /* delete slice */ PyObject **garbage; - Py_ssize_t cur, i; + size_t cur; + Py_ssize_t i; if (slicelength <= 0) return 0;