diff options
author | Martin Panter <vadmium+py@gmail.com> | 2016-09-07 23:31:39 (GMT) |
---|---|---|
committer | Martin Panter <vadmium+py@gmail.com> | 2016-09-07 23:31:39 (GMT) |
commit | 1c748f383033df1126f2f79f051eee440ba08449 (patch) | |
tree | dcb41f4507ff7d705cee8e6e8568da2798fa9807 | |
parent | f3b5bcafcb75a2e350aa447ec7ad3d77a3eaee80 (diff) | |
parent | be8da9c9906571698fe218da9e218ece500d5239 (diff) | |
download | cpython-1c748f383033df1126f2f79f051eee440ba08449.zip cpython-1c748f383033df1126f2f79f051eee440ba08449.tar.gz cpython-1c748f383033df1126f2f79f051eee440ba08449.tar.bz2 |
Issue #27570: Merge null pointer fixes from 3.5
-rw-r--r-- | Lib/test/test_array.py | 14 | ||||
-rw-r--r-- | Misc/NEWS | 3 | ||||
-rw-r--r-- | Modules/_ctypes/_ctypes.c | 6 | ||||
-rw-r--r-- | Modules/_ctypes/stgdict.c | 8 | ||||
-rw-r--r-- | Modules/arraymodule.c | 24 |
5 files changed, 40 insertions, 15 deletions
diff --git a/Lib/test/test_array.py b/Lib/test/test_array.py index 8fd54cc..1f8967c 100644 --- a/Lib/test/test_array.py +++ b/Lib/test/test_array.py @@ -36,14 +36,24 @@ typecodes = "ubBhHiIlLfd" if have_long_long: typecodes += 'qQ' -class BadConstructorTest(unittest.TestCase): +class MiscTest(unittest.TestCase): - def test_constructor(self): + def test_bad_constructor(self): self.assertRaises(TypeError, array.array) self.assertRaises(TypeError, array.array, spam=42) self.assertRaises(TypeError, array.array, 'xx') self.assertRaises(ValueError, array.array, 'x') + def test_empty(self): + # Exercise code for handling zero-length arrays + a = array.array('B') + a[:] = a + self.assertEqual(len(a), 0) + self.assertEqual(len(a + a), 0) + self.assertEqual(len(a * 3), 0) + a += a + self.assertEqual(len(a), 0) + # Machine format codes. # @@ -96,6 +96,9 @@ Core and Builtins Library ------- +- Issue #27570: Avoid zero-length memcpy() etc calls with null source + pointers in the "ctypes" and "array" modules. + - Issue #22233: Break email header lines *only* on the RFC specified CR and LF characters, not on arbitrary unicode line breaks. This also fixes a bug in HTTP header parsing. diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c index f840729..b3a9581 100644 --- a/Modules/_ctypes/_ctypes.c +++ b/Modules/_ctypes/_ctypes.c @@ -1375,8 +1375,10 @@ PyCArrayType_new(PyTypeObject *type, PyObject *args, PyObject *kwds) goto error; } stgdict->shape[0] = length; - memmove(&stgdict->shape[1], itemdict->shape, - sizeof(Py_ssize_t) * (stgdict->ndim - 1)); + if (stgdict->ndim > 1) { + memmove(&stgdict->shape[1], itemdict->shape, + sizeof(Py_ssize_t) * (stgdict->ndim - 1)); + } itemsize = itemdict->size; if (length * itemsize < 0) { diff --git a/Modules/_ctypes/stgdict.c b/Modules/_ctypes/stgdict.c index 879afb8..6c0fda9 100644 --- a/Modules/_ctypes/stgdict.c +++ b/Modules/_ctypes/stgdict.c @@ -391,9 +391,11 @@ PyCStructUnionType_update_stgdict(PyObject *type, PyObject *fields, int isStruct } memset(stgdict->ffi_type_pointer.elements, 0, sizeof(ffi_type *) * (basedict->length + len + 1)); - memcpy(stgdict->ffi_type_pointer.elements, - basedict->ffi_type_pointer.elements, - sizeof(ffi_type *) * (basedict->length)); + if (basedict->length > 0) { + memcpy(stgdict->ffi_type_pointer.elements, + basedict->ffi_type_pointer.elements, + sizeof(ffi_type *) * (basedict->length)); + } ffi_ofs = basedict->length; } else { offset = 0; diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c index 86a58d9..5868c52 100644 --- a/Modules/arraymodule.c +++ b/Modules/arraymodule.c @@ -740,8 +740,10 @@ array_slice(arrayobject *a, Py_ssize_t ilow, Py_ssize_t ihigh) np = (arrayobject *) newarrayobject(&Arraytype, ihigh - ilow, a->ob_descr); if (np == NULL) return NULL; - memcpy(np->ob_item, a->ob_item + ilow * a->ob_descr->itemsize, - (ihigh-ilow) * a->ob_descr->itemsize); + if (ihigh > ilow) { + memcpy(np->ob_item, a->ob_item + ilow * a->ob_descr->itemsize, + (ihigh-ilow) * a->ob_descr->itemsize); + } return (PyObject *)np; } @@ -799,9 +801,13 @@ array_concat(arrayobject *a, PyObject *bb) if (np == NULL) { return NULL; } - memcpy(np->ob_item, a->ob_item, Py_SIZE(a)*a->ob_descr->itemsize); - memcpy(np->ob_item + Py_SIZE(a)*a->ob_descr->itemsize, - b->ob_item, Py_SIZE(b)*b->ob_descr->itemsize); + if (Py_SIZE(a) > 0) { + memcpy(np->ob_item, a->ob_item, Py_SIZE(a)*a->ob_descr->itemsize); + } + if (Py_SIZE(b) > 0) { + memcpy(np->ob_item + Py_SIZE(a)*a->ob_descr->itemsize, + b->ob_item, Py_SIZE(b)*b->ob_descr->itemsize); + } return (PyObject *)np; #undef b } @@ -821,7 +827,7 @@ array_repeat(arrayobject *a, Py_ssize_t n) np = (arrayobject *) newarrayobject(&Arraytype, size, a->ob_descr); if (np == NULL) return NULL; - if (n == 0) + if (size == 0) return (PyObject *)np; oldbytes = Py_SIZE(a) * a->ob_descr->itemsize; newbytes = oldbytes * n; @@ -942,8 +948,10 @@ array_do_extend(arrayobject *self, PyObject *bb) size = oldsize + Py_SIZE(b); if (array_resize(self, size) == -1) return -1; - memcpy(self->ob_item + oldsize * self->ob_descr->itemsize, - b->ob_item, bbsize * b->ob_descr->itemsize); + if (bbsize > 0) { + memcpy(self->ob_item + oldsize * self->ob_descr->itemsize, + b->ob_item, bbsize * b->ob_descr->itemsize); + } return 0; #undef b |