[pypy-commit] pypy default: Test and fix for a segfault in itertools.islice()

[arigo]

Author: Armin Rigo <arigo at tunes.org>
Branch: 
Changeset: r79620:77772e44a71f
Date: 2015-09-14 13:10 +0200
http://bitbucket.org/pypy/pypy/changeset/77772e44a71f/

Log:	Test and fix for a segfault in itertools.islice()

diff --git a/pypy/module/itertools/interp_itertools.py b/pypy/module/itertools/interp_itertools.py
--- a/pypy/module/itertools/interp_itertools.py
+++ b/pypy/module/itertools/interp_itertools.py
@@ -407,11 +407,12 @@
             raise
 
     def _ignore_items(self, num):
-        if self.iterable is None:
+        w_iterator = self.iterable
+        if w_iterator is None:
             raise OperationError(self.space.w_StopIteration, self.space.w_None)
         while True:
             try:
-                self.space.next(self.iterable)
+                self.space.next(w_iterator)
             except OperationError as e:
                 if e.match(self.space, self.space.w_StopIteration):
                     self.iterable = None
diff --git a/pypy/module/itertools/test/test_itertools.py b/pypy/module/itertools/test/test_itertools.py
--- a/pypy/module/itertools/test/test_itertools.py
+++ b/pypy/module/itertools/test/test_itertools.py
@@ -1085,3 +1085,18 @@
                 assert list(itertools.islice(c2, 3)) == expected
                 c3 = pickle.loads(pickle.dumps(c))
                 assert list(itertools.islice(c3, 3)) == expected
+
+    def test_islice_attack(self):
+        import itertools
+        class Iterator(object):
+            first = True
+            def __iter__(self):
+                return self
+            def next(self):
+                if self.first:
+                    self.first = False
+                    list(islice)
+                return 52
+        myiter = Iterator()
+        islice = itertools.islice(myiter, 5, 8)
+        raises(StopIteration, islice.next)