Merged revisions 74169 via svnmerge from

svn+ssh://svn.python.org/python/branches/py3k

................
  r74169 | georg.brandl | 2009-07-22 14:03:59 +0200 (Mi, 22 Jul 2009) | 9 lines

  Merged revisions 74167 via svnmerge from
  svn+ssh://pythondev@svn.python.org/python/trunk

  ........
    r74167 | georg.brandl | 2009-07-22 13:57:15 +0200 (Mi, 22 Jul 2009) | 1 line

    Issue #6540: Fixed crash for bytearray.translate() with invalid parameters.
  ........
................

Lib/test/test_builtin.py

@@ -1229,6 +1229,11 @@ class BuiltinTest(unittest.TestCase):
         self.assertEqual(bin(-(2**65)), '-0b1' + '0' * 65)
         self.assertEqual(bin(-(2**65-1)), '-0b' + '1' * 65)
 
+    def test_bytearray_translate(self):
+        x = bytearray(b"abc")
+        self.assertRaises(ValueError, x.translate, b"1", 1)
+        self.assertRaises(TypeError, x.translate, b"1"*256, 1)
+
 class TestSorted(unittest.TestCase):
 
     def test_basic(self):

Misc/NEWS

@@ -12,6 +12,8 @@ What's New in Python 3.1.1?
 Core and Builtins
 -----------------
 
+- Issue #6540: Fixed crash for bytearray.translate() with invalid parameters.
+
 - Issue #6070: On posix platforms import no longer copies the execute bit
   from the .py file to the .pyc file if it is set.
 

Objects/bytearrayobject.c

@@ -1389,15 +1389,17 @@ bytearray_translate(PyByteArrayObject *self, PyObject *args)
         if (vtable.len != 256) {
             PyErr_SetString(PyExc_ValueError,
                             "translation table must be 256 characters long");
-            goto done;
+            PyBuffer_Release(&vtable);
+            return NULL;
         }
         table = (const char*)vtable.buf;
     }
 
     if (delobj != NULL) {
         if (_getbuffer(delobj, &vdel) < 0) {
-            delobj = NULL;  /* don't try to release vdel buffer on exit */
+            if (tableobj != NULL)
-            goto done;
+                PyBuffer_Release(&vtable);
+            return NULL;
         }
     }
     else {