From 2c40f640d95542c7d63f8ce2d5c00c5381d8a5c3 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Fri, 19 Jul 2013 23:06:21 +0200 Subject: [PATCH] Issue #18408: Fix list_ass_slice(), handle list_resize() failure I tested the patch manually by injecting a fault using gdb: list items are correctly restored on failure. --- Objects/listobject.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/Objects/listobject.c b/Objects/listobject.c index ce6b70889e8..2f203b343f9 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -644,9 +644,14 @@ list_ass_slice(PyListObject *a, Py_ssize_t ilow, Py_ssize_t ihigh, PyObject *v) memcpy(recycle, &item[ilow], s); if (d < 0) { /* Delete -d items */ - memmove(&item[ihigh+d], &item[ihigh], - (Py_SIZE(a) - ihigh)*sizeof(PyObject *)); - list_resize(a, Py_SIZE(a) + d); + Py_ssize_t tail; + tail = (Py_SIZE(a) - ihigh) * sizeof(PyObject *); + memmove(&item[ihigh+d], &item[ihigh], tail); + if (list_resize(a, Py_SIZE(a) + d) < 0) { + memmove(&item[ihigh], &item[ihigh+d], tail); + memcpy(&item[ilow], recycle, s); + goto Error; + } item = a->ob_item; } else if (d > 0) { /* Insert d items */