diff options
| author | Guido van Rossum <guido@python.org> | 2002-03-01 22:24:49 (GMT) |
|---|---|---|
| committer | Guido van Rossum <guido@python.org> | 2002-03-01 22:24:49 (GMT) |
| commit | 2eb0b87d141ff89582ddd7bb414f9958e39fc6ae (patch) | |
| tree | c80c850e549d64ecd53dc858c3167f6c01aaac87 /Objects/object.c | |
| parent | 6f33250ef939356b8a577049cafce1961760fd27 (diff) | |
| download | cpython-2eb0b87d141ff89582ddd7bb414f9958e39fc6ae.zip cpython-2eb0b87d141ff89582ddd7bb414f9958e39fc6ae.tar.gz cpython-2eb0b87d141ff89582ddd7bb414f9958e39fc6ae.tar.bz2 | |
SF patch 514641 (Naofumi Honda) - Negative ob_size of LongObjects
Due to the bizarre definition of _PyLong_Copy(), creating an instance
of a subclass of long with a negative value could cause core dumps
later on. Unfortunately it looks like the behavior of _PyLong_Copy()
is quite intentional, so the fix is more work than feels comfortable.
This fix is almost, but not quite, the code that Naofumi Honda added;
in addition, I added a test case.
Diffstat (limited to 'Objects/object.c')
| -rw-r--r-- | Objects/object.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/Objects/object.c b/Objects/object.c index 5812178..8babf79 100644 --- a/Objects/object.c +++ b/Objects/object.c @@ -1191,8 +1191,14 @@ _PyObject_GetDictPtr(PyObject *obj) if (dictoffset == 0) return NULL; if (dictoffset < 0) { - const size_t size = _PyObject_VAR_SIZE(tp, - ((PyVarObject *)obj)->ob_size); + int tsize; + size_t size; + + tsize = ((PyVarObject *)obj)->ob_size; + if (tsize < 0) + tsize = -tsize; + size = _PyObject_VAR_SIZE(tp, tsize); + dictoffset += (long)size; assert(dictoffset > 0); assert(dictoffset % SIZEOF_VOID_P == 0); |