From 0552fc2b8af80bd93f43001ce9d6b03402630ee2 Mon Sep 17 00:00:00 2001 From: Antoine Pitrou Date: Thu, 1 Nov 2012 20:13:54 +0100 Subject: [PATCH] Issue #16230: Fix a crash in select.select() when one the lists changes size while iterated on. Patch by Serhiy Storchaka. --- Lib/test/test_select.py | 9 +++++++++ Misc/NEWS | 3 +++ Modules/selectmodule.c | 5 +---- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/Lib/test/test_select.py b/Lib/test/test_select.py index 79b249bf411..175bbdac500 100644 --- a/Lib/test/test_select.py +++ b/Lib/test/test_select.py @@ -49,6 +49,15 @@ class SelectTestCase(unittest.TestCase): self.fail('Unexpected return values from select():', rfd, wfd, xfd) p.close() + # Issue 16230: Crash on select resized list + def test_select_mutated(self): + a = [] + class F: + def fileno(self): + del a[-1] + return sys.__stdout__.fileno() + a[:] = [F()] * 10 + self.assertEqual(select.select([], a, []), ([], a[:5], [])) def test_main(): test_support.run_unittest(SelectTestCase) diff --git a/Misc/NEWS b/Misc/NEWS index 3c9ffc0bce0..139216f83b5 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -130,6 +130,9 @@ Core and Builtins Library ------- +- Issue #16230: Fix a crash in select.select() when one the lists changes + size while iterated on. Patch by Serhiy Storchaka. + - Issue #16228: Fix a crash in the json module where a list changes size while it is being encoded. Patch by Serhiy Storchaka. diff --git a/Modules/selectmodule.c b/Modules/selectmodule.c index 5a8580c8ac9..b95b2cedc17 100644 --- a/Modules/selectmodule.c +++ b/Modules/selectmodule.c @@ -87,7 +87,6 @@ seq2set(PyObject *seq, fd_set *set, pylist fd2obj[FD_SETSIZE + 1]) int i; int max = -1; int index = 0; - int len = -1; PyObject* fast_seq = NULL; PyObject* o = NULL; @@ -98,9 +97,7 @@ seq2set(PyObject *seq, fd_set *set, pylist fd2obj[FD_SETSIZE + 1]) if (!fast_seq) return -1; - len = PySequence_Fast_GET_SIZE(fast_seq); - - for (i = 0; i < len; i++) { + for (i = 0; i < PySequence_Fast_GET_SIZE(fast_seq); i++) { SOCKET v; /* any intervening fileno() calls could decr this refcnt */