deque_traverse(): If the deque had one block, and its rightindex was

BLOCKLEN-1, this assert-failed in a debug build, or went wild with a
NULL pointer in a release build.  Reported on c.l.py by Stefan Behnel.

1 files changed, 13 insertions, 10 deletions

diff --git a/Modules/collectionsmodule.c b/Modules/collectionsmodule.c
index f8a6f61..196cbe2 100644
--- a/Modules/collectionsmodule.c
+++ b/Modules/collectionsmodule.c
@@ -478,19 +478,22 @@ deque_dealloc(dequeobject *deque)
 static int
 deque_traverse(dequeobject *deque, visitproc visit, void *arg)
 {
-	block * b = deque->leftblock;
-	int index = deque->leftindex;
+	block *b;
 	PyObject *item;
+	int index;
+	int indexlo = deque->leftindex;
 
-	while (b != deque->rightblock || index <= deque->rightindex) {
-		item = b->data[index];
-		index++;
-		if (index == BLOCKLEN ) {
-			assert(b->rightlink != NULL);
-			b = b->rightlink;
-			index = 0;
+	assert(deque->leftblock != NULL);
+	for (b = deque->leftblock; b != NULL; b = b->rightlink) {
+		const int indexhi = b == deque->rightblock ?
+					 deque->rightindex :
+				    	 BLOCKLEN - 1;
+
+		for (index = indexlo; index <= indexhi; ++index) {
+			item = b->data[index];
+			Py_VISIT(item);
 		}
-		Py_VISIT(item);
+		indexlo = 0;
 	}
 	return 0;
 }