diff options
| author | Victor Stinner <victor.stinner@gmail.com> | 2017-05-03 14:00:12 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-05-03 14:00:12 (GMT) |
| commit | f6a3133972378205baaa6a854d46170d04a2db67 (patch) | |
| tree | 7d3cea53253ff1d8e21814d47b7f58d22c006ec9 /Objects/sliceobject.c | |
| parent | 0d493795c8601d600a93e6a00e6c8ef3620d5aab (diff) | |
| download | cpython-f6a3133972378205baaa6a854d46170d04a2db67.zip cpython-f6a3133972378205baaa6a854d46170d04a2db67.tar.gz cpython-f6a3133972378205baaa6a854d46170d04a2db67.tar.bz2 | |
bpo-30255: Clip step in _PySlice_Unpack() (#1429)
In PySlice_IndicesEx, clip the step to [-PY_SSIZE_T_MAX,
PY_SSIZE_T_MAX] rather than [PY_SSIZE_T_MIN, PY_SSIZE_T_MAX].
(cherry picked from commit e6fc7401a92c7b51a80782d8095819b9909a0322)
Diffstat (limited to 'Objects/sliceobject.c')
| -rw-r--r-- | Objects/sliceobject.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/Objects/sliceobject.c b/Objects/sliceobject.c index 8f17fca..64be927 100644 --- a/Objects/sliceobject.c +++ b/Objects/sliceobject.c @@ -147,6 +147,13 @@ _PySlice_Unpack(PyObject *_r, "slice step cannot be zero"); return -1; } + /* Here *step might be -PY_SSIZE_T_MAX-1; in this case we replace it + * with -PY_SSIZE_T_MAX. This doesn't affect the semantics, and it + * guards against later undefined behaviour resulting from code that + * does "step = -step" as part of a slice reversal. + */ + if (*step < -PY_SSIZE_T_MAX) + *step = -PY_SSIZE_T_MAX; } if (r->start == Py_None) { |