[Python-checkins] python/dist/src/Objects listobject.c,2.108,2.109 sliceobject.c,2.12,2.13 stringobject.c,2.165,2.166 tupleobject.c,2.64,2.65 unicodeobject.c,2.151,2.152

[Neal Norwitz]

Michael:

There is a problem with the patch below.
I think it is a general problem (for all types).
I verified w/lists only.  I'll describe the problem inline below.

>>> n = [1, 2, 3]
>>> n[10000:30000:2]
Segmentation fault (core dumped)


mwh@users.sourceforge.net wrote:
> 
> Modified Files:
>         listobject.c sliceobject.c stringobject.c tupleobject.c
>         unicodeobject.c
> Log Message:
> This is my nearly two year old patch
> 
> [ 400998 ] experimental support for extended slicing on lists
> 
> somewhat spruced up and better tested than it was when I wrote it.
> 
> Includes docs & tests.  The whatsnew section needs expanding, and arrays
> should support extended slices -- later.
> 
> Index: listobject.c
> ===================================================================
> +       else if (PySlice_Check(item)) {
> +               int start, stop, step, slicelength, cur, i;
> +               PyObject* result;
> +               PyObject* it;
> +
> +               if (PySlice_GetIndicesEx((PySliceObject*)item, self->ob_size,
> +                                &start, &stop, &step, &slicelength) < 0) {
> +                       return NULL;
> +               }
> +
> +               if (slicelength <= 0) {
> +                       return PyList_New(0);
> +               }
> +               else {
> +                       result = PyList_New(slicelength);
> +                       if (!result) return NULL;
> +
> +                       for (cur = start, i = 0; i < slicelength;
> +                            cur += step, i++) {
> +                               it = PyList_GET_ITEM(self, cur);

Here is where the problem is.  You are referencing self list
with cur, but cur is not guaranteed to be < list length.
I think all you have to do is add another condition to the for loop
 && cur < PyList_Length(self) (or should that be PyList_Size(self)?).

I suspect this is true of strings, unicode, tuples, and any other
sequence types.

Hopefully, this makes sense.

Neal