#3967: Correct a crash in count() and find() methods of string-like objects.

For example:
   "".count("xxxx", sys.maxint, 0)

Reviewed by Benjamin Peterson.
Will port to 2.5 and 3.0.

4 files changed, 25 insertions, 8 deletions

diff --git a/Lib/test/string_tests.py b/Lib/test/string_tests.py
index 63279ec..e66855d 100644
--- a/Lib/test/string_tests.py
+++ b/Lib/test/string_tests.py
@@ -120,6 +120,14 @@ class CommonTest(unittest.TestCase):
         self.checkequal(2, 'aaa', 'count', '', -1)
         self.checkequal(4, 'aaa', 'count', '', -10)
 
+        self.checkequal(1, '', 'count', '')
+        self.checkequal(0, '', 'count', '', 1, 1)
+        self.checkequal(0, '', 'count', '', sys.maxint, 0)
+
+        self.checkequal(0, '', 'count', 'xx')
+        self.checkequal(0, '', 'count', 'xx', 1, 1)
+        self.checkequal(0, '', 'count', 'xx', sys.maxint, 0)
+
         self.checkraises(TypeError, 'hello', 'count')
         self.checkraises(TypeError, 'hello', 'count', 42)
 
@@ -169,6 +177,14 @@ class CommonTest(unittest.TestCase):
         self.checkraises(TypeError, 'hello', 'find')
         self.checkraises(TypeError, 'hello', 'find', 42)
 
+        self.checkequal(0, '', 'find', '')
+        self.checkequal(-1, '', 'find', '', 1, 1)
+        self.checkequal(-1, '', 'find', '', sys.maxint, 0)
+
+        self.checkequal(-1, '', 'find', 'xx')
+        self.checkequal(-1, '', 'find', 'xx', 1, 1)
+        self.checkequal(-1, '', 'find', 'xx', sys.maxint, 0)
+
         # For a variety of combinations,
         #    verify that str.find() matches __contains__
         #    and that the found substring is really at that location
diff --git a/Misc/NEWS b/Misc/NEWS
index 660e88a..e79760e 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 2.6 final
 Core and Builtins
 -----------------
 
+- Issue #3967: Fixed a crash in the count() and find() methods of string-like
+  objects, when the "start" parameter is a huge value.
+
 - Issue #3965: Fixed a crash on Windows when open() is given an invalid
   filename or mode, and the filename is a unicode string.
 
diff --git a/Objects/stringlib/count.h b/Objects/stringlib/count.h
index 367a15c..eba37e9 100644
--- a/Objects/stringlib/count.h
+++ b/Objects/stringlib/count.h
@@ -13,11 +13,10 @@ stringlib_count(const STRINGLIB_CHAR* str, Py_ssize_t str_len,
 {
     Py_ssize_t count;
 
-    if (sub_len == 0) {
-        if (str_len < 0)
-            return 0; /* start > len(str) */
+    if (str_len < 0)
+        return 0; /* start > len(str) */
+    if (sub_len == 0)
         return str_len + 1;
-    }
 
     count = fastsearch(str, str_len, sub, sub_len, FAST_COUNT);
 
diff --git a/Objects/stringlib/find.h b/Objects/stringlib/find.h
index 9e0d299..fbe99c7 100644
--- a/Objects/stringlib/find.h
+++ b/Objects/stringlib/find.h
@@ -14,11 +14,10 @@ stringlib_find(const STRINGLIB_CHAR* str, Py_ssize_t str_len,
 {
     Py_ssize_t pos;
 
-    if (sub_len == 0) {
-        if (str_len < 0)
-            return -1;
+    if (str_len < 0)
+        return -1;
+    if (sub_len == 0)
         return offset;
-    }
 
     pos = fastsearch(str, str_len, sub, sub_len, FAST_SEARCH);