diff options
author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2024-06-21 11:16:24 (GMT) |
---|---|---|
committer | GitHub <noreply@github.com> | 2024-06-21 11:16:24 (GMT) |
commit | f3d7823ede41f7650ae7a199186cb63f62031441 (patch) | |
tree | 53abaac8159c7d00ab1c1849590e6edcc7af9dd5 /Objects/listobject.c | |
parent | 730285519ec6afb571409ec7fd3dbdf131bfbdab (diff) | |
download | cpython-f3d7823ede41f7650ae7a199186cb63f62031441.zip cpython-f3d7823ede41f7650ae7a199186cb63f62031441.tar.gz cpython-f3d7823ede41f7650ae7a199186cb63f62031441.tar.bz2 |
[3.13] gh-120384: Fix array-out-of-bounds crash in `list_ass_subscript` (GH-120442) (#120826)
gh-120384: Fix array-out-of-bounds crash in `list_ass_subscript` (GH-120442)
(cherry picked from commit 8334a1b55c93068f5d243852029baa83377ff6c9)
Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Diffstat (limited to 'Objects/listobject.c')
-rw-r--r-- | Objects/listobject.c | 45 |
1 files changed, 33 insertions, 12 deletions
diff --git a/Objects/listobject.c b/Objects/listobject.c index 6829d5d..a05ddea 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -3581,6 +3581,23 @@ list_subscript(PyObject* _self, PyObject* item) } } +static Py_ssize_t +adjust_slice_indexes(PyListObject *lst, + Py_ssize_t *start, Py_ssize_t *stop, + Py_ssize_t step) +{ + Py_ssize_t slicelength = PySlice_AdjustIndices(Py_SIZE(lst), start, stop, + step); + + /* Make sure s[5:2] = [..] inserts at the right place: + before 5, not before 2. */ + if ((step < 0 && *start < *stop) || + (step > 0 && *start > *stop)) + *stop = *start; + + return slicelength; +} + static int list_ass_subscript(PyObject* _self, PyObject* item, PyObject* value) { @@ -3594,22 +3611,11 @@ list_ass_subscript(PyObject* _self, PyObject* item, PyObject* value) return list_ass_item((PyObject *)self, i, value); } else if (PySlice_Check(item)) { - Py_ssize_t start, stop, step, slicelength; + Py_ssize_t start, stop, step; if (PySlice_Unpack(item, &start, &stop, &step) < 0) { return -1; } - slicelength = PySlice_AdjustIndices(Py_SIZE(self), &start, &stop, - step); - - if (step == 1) - return list_ass_slice(self, start, stop, value); - - /* Make sure s[5:2] = [..] inserts at the right place: - before 5, not before 2. */ - if ((step < 0 && start < stop) || - (step > 0 && start > stop)) - stop = start; if (value == NULL) { /* delete slice */ @@ -3618,6 +3624,12 @@ list_ass_subscript(PyObject* _self, PyObject* item, PyObject* value) Py_ssize_t i; int res; + Py_ssize_t slicelength = adjust_slice_indexes(self, &start, &stop, + step); + + if (step == 1) + return list_ass_slice(self, start, stop, value); + if (slicelength <= 0) return 0; @@ -3695,6 +3707,15 @@ list_ass_subscript(PyObject* _self, PyObject* item, PyObject* value) if (!seq) return -1; + Py_ssize_t slicelength = adjust_slice_indexes(self, &start, &stop, + step); + + if (step == 1) { + int res = list_ass_slice(self, start, stop, seq); + Py_DECREF(seq); + return res; + } + if (PySequence_Fast_GET_SIZE(seq) != slicelength) { PyErr_Format(PyExc_ValueError, "attempt to assign sequence of " |