diff options
| author | Alexey Izbyshev <izbyshev@ispras.ru> | 2019-05-23 00:01:08 (GMT) |
|---|---|---|
| committer | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2019-05-23 00:01:08 (GMT) |
| commit | 6bc5917903b722bdd0e5d3020949f26fec5dfe9a (patch) | |
| tree | 2e5e54d89a314efadf11aa0f0a48ab571a511813 | |
| parent | df22c03b93ea4620fdf4a0b3cbbbfa7c645af783 (diff) | |
| download | cpython-6bc5917903b722bdd0e5d3020949f26fec5dfe9a.zip cpython-6bc5917903b722bdd0e5d3020949f26fec5dfe9a.tar.gz cpython-6bc5917903b722bdd0e5d3020949f26fec5dfe9a.tar.bz2 | |
bpo-35091: Objects/listobject.c: Replace overflow checks in gallop fu… (GH-10202)
…nctions with asserts
The actual overflow can never happen because of the following:
* The size of a list can't be greater than PY_SSIZE_T_MAX / sizeof(PyObject*).
* The size of a pointer on all supported plaftorms is at least 4 bytes.
* ofs is positive and less than the list size at the beginning of each iteration.
https://bugs.python.org/issue35091
| -rw-r--r-- | Objects/listobject.c | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/Objects/listobject.c b/Objects/listobject.c index 08b3e89..3185957 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -1380,9 +1380,8 @@ gallop_left(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize_ while (ofs < maxofs) { IFLT(a[ofs], key) { lastofs = ofs; + assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2); ofs = (ofs << 1) + 1; - if (ofs <= 0) /* int overflow */ - ofs = maxofs; } else /* key <= a[hint + ofs] */ break; @@ -1403,9 +1402,8 @@ gallop_left(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize_ break; /* key <= a[hint - ofs] */ lastofs = ofs; + assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2); ofs = (ofs << 1) + 1; - if (ofs <= 0) /* int overflow */ - ofs = maxofs; } if (ofs > maxofs) ofs = maxofs; @@ -1471,9 +1469,8 @@ gallop_right(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize while (ofs < maxofs) { IFLT(key, *(a-ofs)) { lastofs = ofs; + assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2); ofs = (ofs << 1) + 1; - if (ofs <= 0) /* int overflow */ - ofs = maxofs; } else /* a[hint - ofs] <= key */ break; @@ -1495,9 +1492,8 @@ gallop_right(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize break; /* a[hint + ofs] <= key */ lastofs = ofs; + assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2); ofs = (ofs << 1) + 1; - if (ofs <= 0) /* int overflow */ - ofs = maxofs; } if (ofs > maxofs) ofs = maxofs; |