diff options
| author | Zackery Spytz <zspytz@gmail.com> | 2019-05-17 07:13:03 (GMT) |
|---|---|---|
| committer | Serhiy Storchaka <storchaka@gmail.com> | 2019-05-17 07:13:03 (GMT) |
| commit | 14514d9084a40f599c57da853a305aa264562a43 (patch) | |
| tree | 36cb61b74dbfda9ce1cdf72a864b640d0bda546d /Modules/arraymodule.c | |
| parent | 870b035bc6da96689b59dd6f79782ec6f1873617 (diff) | |
| download | cpython-14514d9084a40f599c57da853a305aa264562a43.zip cpython-14514d9084a40f599c57da853a305aa264562a43.tar.gz cpython-14514d9084a40f599c57da853a305aa264562a43.tar.bz2 | |
bpo-36946: Fix possible signed integer overflow when handling slices. (GH-13375)
The final addition (cur += step) may overflow, so use size_t for "cur".
"cur" is always positive (even for negative steps), so it is safe to use
size_t here.
Co-Authored-By: Martin Panter <vadmium+py@gmail.com>
Diffstat (limited to 'Modules/arraymodule.c')
| -rw-r--r-- | Modules/arraymodule.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c index 4be3beb..523afb9 100644 --- a/Modules/arraymodule.c +++ b/Modules/arraymodule.c @@ -2343,7 +2343,8 @@ array_subscr(arrayobject* self, PyObject* item) return array_item(self, i); } else if (PySlice_Check(item)) { - Py_ssize_t start, stop, step, slicelength, cur, i; + Py_ssize_t start, stop, step, slicelength, i; + size_t cur; PyObject* result; arrayobject* ar; int itemsize = self->ob_descr->itemsize; @@ -2527,7 +2528,8 @@ array_ass_subscr(arrayobject* self, PyObject* item, PyObject* value) return 0; } else { - Py_ssize_t cur, i; + size_t cur; + Py_ssize_t i; if (needed != slicelength) { PyErr_Format(PyExc_ValueError, |