[Python-Dev] can this overflow (list insertion)?

[Vladimir Marangozov]

Trent Mick wrote:
>
> [listobject.c/ins1()]
> ...
>     self->ob_item = items;
>     self->ob_size++;         <-------------- can this overflow?
>     return 0;
> }
> 
> 
> In the case of sizeof(int) < sizeof(void*), can this overflow. I have a small
> patch to text self->ob_size against INT_MAX and I was going to submit it but
> I am not so sure that overflow is not checked by some other mechanism for
> list insert.

+0.

It could overflow but if it does, this is a bad sign about using a list
for such huge amount of data.

And this is the second time in a week that I see an attempt to introduce
a bogus counter due to post-increments embedded in an if statement!

> Is it or was this relying on sizeof(ob_size) == sizeof(void*),
> hence a list being able to hold as many items as there is addressable memory?
> 
> scared-to-patch-ly yours,
> Trent

And you're right <wink>

> 
> 
> proposed patch:
> 
> *** python/dist/src/Objects/listobject.c Fri Aug 11 16:25:08 2000
> --- Python/dist/src/Objects/listobject.c Fri Aug 11 16:25:36 2000
> ***************
> *** 149,155 ****
>         Py_INCREF(v);
>         items[where] = v;
>         self->ob_item = items;
> !       self->ob_size++;
>         return 0;
>   }
> 
> --- 149,159 ----
>         Py_INCREF(v);
>         items[where] = v;
>         self->ob_item = items;
> !       if (self->ob_size++ == INT_MAX) {
> !               PyErr_SetString(PyExc_OverflowError,
> !                       "cannot add more objects to list");
> !               return -1;
> !       }
>         return 0;
>   }
> 
> 
> 
> 
> -- 
> Trent Mick
> TrentM@ActiveState.com
> 
> _______________________________________________
> Python-Dev mailing list
> Python-Dev@python.org
> http://www.python.org/mailman/listinfo/python-dev
> 


-- 
       Vladimir MARANGOZOV          | Vladimir.Marangozov@inrialpes.fr
http://sirac.inrialpes.fr/~marangoz | tel:(+33-4)76615277 fax:76615252