diff options
| author | Mark Dickinson <dickinsm@gmail.com> | 2010-08-06 21:33:18 (GMT) |
|---|---|---|
| committer | Mark Dickinson <dickinsm@gmail.com> | 2010-08-06 21:33:18 (GMT) |
| commit | 7e3b948cfeba35411a6ef3a9e6455b46c57a9bd6 (patch) | |
| tree | 51a100b3c8ef84aa29aae80c6c6d1a26b5fc1e79 /Objects | |
| parent | d0511b0efbae0896ffebc8848b456daf280a3f85 (diff) | |
| download | cpython-7e3b948cfeba35411a6ef3a9e6455b46c57a9bd6.zip cpython-7e3b948cfeba35411a6ef3a9e6455b46c57a9bd6.tar.gz cpython-7e3b948cfeba35411a6ef3a9e6455b46c57a9bd6.tar.bz2 | |
Issue #9530: Fix a couple of places where undefined behaviour can
occur, as a result of signed integer overflow.
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/bytearrayobject.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c index 021ab1a..33f80d5 100644 --- a/Objects/bytearrayobject.c +++ b/Objects/bytearrayobject.c @@ -649,6 +649,11 @@ bytearray_ass_subscript(PyByteArrayObject *self, PyObject *index, PyObject *valu if (!_canresize(self)) return -1; + + if (slicelen == 0) + /* Nothing to do here. */ + return 0; + if (step < 0) { stop = start + 1; start = stop + step * (slicelen - 1) - 1; @@ -665,7 +670,7 @@ bytearray_ass_subscript(PyByteArrayObject *self, PyObject *index, PyObject *valu self->ob_bytes + cur + 1, lim); } /* Move the tail of the bytes, in one chunk */ - cur = start + slicelen*step; + cur = start + (size_t)slicelen*step; if (cur < (size_t)PyByteArray_GET_SIZE(self)) { memmove(self->ob_bytes + cur - slicelen, self->ob_bytes + cur, @@ -679,7 +684,8 @@ bytearray_ass_subscript(PyByteArrayObject *self, PyObject *index, PyObject *valu } else { /* Assign slice */ - Py_ssize_t cur, i; + Py_ssize_t i; + size_t cur; if (needed != slicelen) { PyErr_Format(PyExc_ValueError, |