traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Issue 21375: Fix possible Py_ssizet overflow in heapq.

This commit is contained in:
Raymond Hettinger 2014-05-03 15:22:07 -07:00
parent ceced6bfea
commit c9926088dd
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
Modules/_heapqmodule.c
View File

@ -62,7 +62,7 @@ _siftdown(PyListObject *heap, Py_ssize_t startpos, Py_ssize_t pos)
static int static int
_siftup(PyListObject *heap, Py_ssize_t pos) _siftup(PyListObject *heap, Py_ssize_t pos)
{ {
Py_ssize_t startpos, endpos, childpos, rightpos; Py_ssize_t startpos, endpos, childpos, rightpos, limit;
int cmp; int cmp;
PyObject *newitem, *tmp, *olditem; PyObject *newitem, *tmp, *olditem;
Py_ssize_t size; Py_ssize_t size;
@ -79,9 +79,10 @@ _siftup(PyListObject *heap, Py_ssize_t pos)
Py_INCREF(newitem); Py_INCREF(newitem);
/* Bubble up the smaller child until hitting a leaf. */ /* Bubble up the smaller child until hitting a leaf. */
childpos = 2*pos + 1; /* leftmost child position */ limit = endpos / 2; /* smallest pos that has no child */
while (childpos < endpos) { while (pos < limit) {
/* Set childpos to index of smaller child. */ /* Set childpos to index of smaller child. */
childpos = 2*pos + 1; /* leftmost child position */
rightpos = childpos + 1; rightpos = childpos + 1;
if (rightpos < endpos) { if (rightpos < endpos) {
cmp = PyObject_RichCompareBool( cmp = PyObject_RichCompareBool(
@ -108,7 +109,6 @@ _siftup(PyListObject *heap, Py_ssize_t pos)
PyList_SET_ITEM(heap, pos, tmp); PyList_SET_ITEM(heap, pos, tmp);
Py_DECREF(olditem); Py_DECREF(olditem);
pos = childpos; pos = childpos;
childpos = 2*pos + 1;
if (size != PyList_GET_SIZE(heap)) { if (size != PyList_GET_SIZE(heap)) {
PyErr_SetString(PyExc_RuntimeError, PyErr_SetString(PyExc_RuntimeError,
"list changed size during iteration"); "list changed size during iteration");
@ -419,7 +419,7 @@ _siftdownmax(PyListObject *heap, Py_ssize_t startpos, Py_ssize_t pos)
static int static int
_siftupmax(PyListObject *heap, Py_ssize_t pos) _siftupmax(PyListObject *heap, Py_ssize_t pos)
{ {
Py_ssize_t startpos, endpos, childpos, rightpos; Py_ssize_t startpos, endpos, childpos, rightpos, limit;
int cmp; int cmp;
PyObject *newitem, *tmp; PyObject *newitem, *tmp;
@ -434,9 +434,10 @@ _siftupmax(PyListObject *heap, Py_ssize_t pos)
Py_INCREF(newitem); Py_INCREF(newitem);
/* Bubble up the smaller child until hitting a leaf. */ /* Bubble up the smaller child until hitting a leaf. */
childpos = 2*pos + 1; /* leftmost child position */ limit = endpos / 2; /* smallest pos that has no child */
while (childpos < endpos) { while (pos < limit) {
/* Set childpos to index of smaller child. */ /* Set childpos to index of smaller child. */
childpos = 2*pos + 1; /* leftmost child position */
rightpos = childpos + 1; rightpos = childpos + 1;
if (rightpos < endpos) { if (rightpos < endpos) {
cmp = PyObject_RichCompareBool( cmp = PyObject_RichCompareBool(
@ -456,7 +457,6 @@ _siftupmax(PyListObject *heap, Py_ssize_t pos)
Py_DECREF(PyList_GET_ITEM(heap, pos)); Py_DECREF(PyList_GET_ITEM(heap, pos));
PyList_SET_ITEM(heap, pos, tmp); PyList_SET_ITEM(heap, pos, tmp);
pos = childpos; pos = childpos;
childpos = 2*pos + 1;
} }
/* The leaf at pos is empty now. Put newitem there, and bubble /* The leaf at pos is empty now. Put newitem there, and bubble