traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Issue #12973: Fix undefined-behaviour-inducing overflow check in list_repeat.

This commit is contained in:
Mark Dickinson 2011-09-19 19:18:37 +01:00
parent bc566b00ad
commit c0420fd42a
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Misc/NEWS
View File

@ -10,6 +10,10 @@ What's New in Python 3.2.3?
Core and Builtins
-----------------
- Issue #12973: Fix overflow check that relied on undefined behaviour in
list_repeat. This bug caused test_list to fail with recent versions
of Clang.
- Issue #12802: the Windows error ERROR_DIRECTORY (numbered 267) is now
mapped to POSIX errno ENOTDIR (previously EINVAL).

6
Objects/listobject.c
View File

@ -58,7 +58,7 @@ list_resize(PyListObject *self, Py_ssize_t newsize)
if (newsize == 0)
new_allocated = 0;
items = self->ob_item;
if (new_allocated <= ((~(size_t)0) / sizeof(PyObject *)))
if (new_allocated <= (PY_SIZE_MAX / sizeof(PyObject *)))
PyMem_RESIZE(items, PyObject *, new_allocated);
else
items = NULL;
@ -510,9 +510,9 @@ list_repeat(PyListObject *a, Py_ssize_t n)
PyObject *elem;
if (n < 0)
n = 0;
size = Py_SIZE(a) * n;
if (n && size/n != Py_SIZE(a))
if (n > 0 && Py_SIZE(a) > PY_SSIZE_T_MAX / n)
return PyErr_NoMemory();
size = Py_SIZE(a) * n;
if (size == 0)
return PyList_New(0);
np = (PyListObject *) PyList_New(size);