[Python-checkins] cpython (3.2): Issue #12973: Fix undefined-behaviour-inducing overflow check in list_repeat.
mark.dickinson
python-checkins at python.org
Mon Sep 19 20:20:34 CEST 2011
http://hg.python.org/cpython/rev/99b808c94834
changeset: 72417:99b808c94834
branch: 3.2
parent: 72414:7a41855b6196
user: Mark Dickinson <mdickinson at enthought.com>
date: Mon Sep 19 19:18:37 2011 +0100
summary:
Issue #12973: Fix undefined-behaviour-inducing overflow check in list_repeat.
files:
Misc/NEWS | 4 ++++
Objects/listobject.c | 6 +++---
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,10 @@
Core and Builtins
-----------------
+- Issue #12973: Fix overflow check that relied on undefined behaviour in
+ list_repeat. This bug caused test_list to fail with recent versions
+ of Clang.
+
- Issue #12802: the Windows error ERROR_DIRECTORY (numbered 267) is now
mapped to POSIX errno ENOTDIR (previously EINVAL).
diff --git a/Objects/listobject.c b/Objects/listobject.c
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -58,7 +58,7 @@
if (newsize == 0)
new_allocated = 0;
items = self->ob_item;
- if (new_allocated <= ((~(size_t)0) / sizeof(PyObject *)))
+ if (new_allocated <= (PY_SIZE_MAX / sizeof(PyObject *)))
PyMem_RESIZE(items, PyObject *, new_allocated);
else
items = NULL;
@@ -510,9 +510,9 @@
PyObject *elem;
if (n < 0)
n = 0;
+ if (n > 0 && Py_SIZE(a) > PY_SSIZE_T_MAX / n)
+ return PyErr_NoMemory();
size = Py_SIZE(a) * n;
- if (n && size/n != Py_SIZE(a))
- return PyErr_NoMemory();
if (size == 0)
return PyList_New(0);
np = (PyListObject *) PyList_New(size);
--
Repository URL: http://hg.python.org/cpython
More information about the Python-checkins
mailing list