From a53f2c997eb6070cc59a6675a10514c9e18f2c9e Mon Sep 17 00:00:00 2001 From: Mark Dickinson Date: Fri, 29 Jan 2010 17:29:21 +0000 Subject: Merged revisions 77823 via svnmerge from svn+ssh://pythondev@svn.python.org/python/branches/py3k ................ r77823 | mark.dickinson | 2010-01-29 17:27:24 +0000 (Fri, 29 Jan 2010) | 10 lines Merged revisions 77821 via svnmerge from svn+ssh://pythondev@svn.python.org/python/trunk ........ r77821 | mark.dickinson | 2010-01-29 17:11:39 +0000 (Fri, 29 Jan 2010) | 3 lines Issue #7788: Fix a crash produced by deleting a list slice with huge step value. Patch by Marcin Bachry. ........ ................ --- Lib/test/list_tests.py | 3 +++ Lib/test/test_array.py | 3 +++ Lib/test/test_bytes.py | 2 +- Misc/NEWS | 3 +++ Modules/arraymodule.c | 5 +++-- Objects/bytearrayobject.c | 3 ++- Objects/listobject.c | 3 ++- 7 files changed, 17 insertions(+), 5 deletions(-) diff --git a/Lib/test/list_tests.py b/Lib/test/list_tests.py index 67492f3..e2889cc 100644 --- a/Lib/test/list_tests.py +++ b/Lib/test/list_tests.py @@ -540,6 +540,9 @@ class CommonTest(seq_tests.CommonTest): a = self.type2test(range(10)) a[::2] = tuple(range(5)) self.assertEqual(a, self.type2test([0, 1, 1, 3, 2, 5, 3, 7, 4, 9])) + # test issue7788 + a = self.type2test(range(10)) + del a[9::1<<333] def test_constructor_exception_handling(self): # Bug #1242657 diff --git a/Lib/test/test_array.py b/Lib/test/test_array.py index 93c6cc0..dd01574 100755 --- a/Lib/test/test_array.py +++ b/Lib/test/test_array.py @@ -848,6 +848,9 @@ class NumberTest(BaseTest): a = array.array(self.typecode, range(10)) del a[::1000] self.assertEqual(a, array.array(self.typecode, [1,2,3,4,5,6,7,8,9])) + # test issue7788 + a = array.array(self.typecode, range(10)) + del a[9::1<<333] def test_assignment(self): a = array.array(self.typecode, range(10)) diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py index 9ccc787..b83a83f 100644 --- a/Lib/test/test_bytes.py +++ b/Lib/test/test_bytes.py @@ -595,7 +595,7 @@ class ByteArrayTest(BaseBytesTest): self.assertEqual(b, bytearray([0, 1, 2, 42, 42, 42, 3, 4, 5, 6, 7, 8, 9])) def test_extended_set_del_slice(self): - indices = (0, None, 1, 3, 19, 300, -1, -2, -31, -300) + indices = (0, None, 1, 3, 19, 300, 1<<333, -1, -2, -31, -300) for start in indices: for stop in indices: # Skip invalid step 0 diff --git a/Misc/NEWS b/Misc/NEWS index e3d94da..4eba51b 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -12,6 +12,9 @@ What's New in Python 3.1.2? Core and Builtins ----------------- +- Issue #7788: Fix an interpreter crash produced by deleting a list + slice with very large step value. + - Issue #7561: Operations on empty bytearrays (such as `int(bytearray())`) could crash in many places because of the PyByteArray_AS_STRING() macro returning NULL. The macro now returns a statically allocated empty diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c index b24b4c9..aef0649 100644 --- a/Modules/arraymodule.c +++ b/Modules/arraymodule.c @@ -1733,8 +1733,9 @@ array_ass_subscr(arrayobject* self, PyObject* item, PyObject* value) } else if (needed == 0) { /* Delete slice */ - Py_ssize_t cur, i; - + size_t cur; + Py_ssize_t i; + if (step < 0) { stop = start + 1; start = stop + step * (slicelength - 1) - 1; diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c index d80e694..39aa69a 100644 --- a/Objects/bytearrayobject.c +++ b/Objects/bytearrayobject.c @@ -650,7 +650,8 @@ bytearray_ass_subscript(PyByteArrayObject *self, PyObject *index, PyObject *valu else { if (needed == 0) { /* Delete slice */ - Py_ssize_t cur, i; + size_t cur; + Py_ssize_t i; if (!_canresize(self)) return -1; diff --git a/Objects/listobject.c b/Objects/listobject.c index 09fba48..c1ece2b 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -2430,7 +2430,8 @@ list_ass_subscript(PyListObject* self, PyObject* item, PyObject* value) if (value == NULL) { /* delete slice */ PyObject **garbage; - Py_ssize_t cur, i; + size_t cur; + Py_ssize_t i; if (slicelength <= 0) return 0; -- cgit v0.12