From 3c87a667bb367ace1de6bd1577fdb4f66947da52 Mon Sep 17 00:00:00 2001 From: HongWeipeng Date: Sun, 8 Sep 2019 18:15:56 +0800 Subject: bpo-36946:Fix possible signed integer overflow when handling slices. (GH-15639) This is a complement to PR 13375. --- Lib/test/test_list.py | 5 +++++ .../next/Core and Builtins/2019-09-02-16-17-42.bpo-36946._lAuSR.rst | 1 + Modules/_ctypes/_ctypes.c | 3 ++- Objects/listobject.c | 6 ++++-- 4 files changed, 12 insertions(+), 3 deletions(-) create mode 100644 Misc/NEWS.d/next/Core and Builtins/2019-09-02-16-17-42.bpo-36946._lAuSR.rst diff --git a/Lib/test/test_list.py b/Lib/test/test_list.py index c5002b1..fe4b2cd 100644 --- a/Lib/test/test_list.py +++ b/Lib/test/test_list.py @@ -150,6 +150,11 @@ class ListTest(list_tests.CommonTest): a[:] = data self.assertEqual(list(it), []) + def test_step_overflow(self): + a = [0, 1, 2, 3, 4] + a[1::sys.maxsize] = [0] + self.assertEqual(a[3::sys.maxsize], [3]) + def test_no_comdat_folding(self): # Issue 8847: In the PGO build, the MSVC linker's COMDAT folding # optimization causes failures in code that relies on distinct diff --git a/Misc/NEWS.d/next/Core and Builtins/2019-09-02-16-17-42.bpo-36946._lAuSR.rst b/Misc/NEWS.d/next/Core and Builtins/2019-09-02-16-17-42.bpo-36946._lAuSR.rst new file mode 100644 index 0000000..e0c5d71 --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2019-09-02-16-17-42.bpo-36946._lAuSR.rst @@ -0,0 +1 @@ +Fix possible signed integer overflow when handling slices. Patch by hongweipeng. diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c index 95bfe9d..d2f6391 100644 --- a/Modules/_ctypes/_ctypes.c +++ b/Modules/_ctypes/_ctypes.c @@ -5195,7 +5195,8 @@ Pointer_subscript(PyObject *myself, PyObject *item) PyObject *np; StgDictObject *stgdict, *itemdict; PyObject *proto; - Py_ssize_t i, len, cur; + Py_ssize_t i, len; + size_t cur; /* Since pointers have no length, and we want to apply different semantics to negative indices than normal diff --git a/Objects/listobject.c b/Objects/listobject.c index 5fca08e..645742b 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -2789,7 +2789,8 @@ list_subscript(PyListObject* self, PyObject* item) return list_item(self, i); } else if (PySlice_Check(item)) { - Py_ssize_t start, stop, step, slicelength, cur, i; + Py_ssize_t start, stop, step, slicelength, i; + size_t cur; PyObject* result; PyObject* it; PyObject **src, **dest; @@ -2925,7 +2926,8 @@ list_ass_subscript(PyListObject* self, PyObject* item, PyObject* value) /* assign slice */ PyObject *ins, *seq; PyObject **garbage, **seqitems, **selfitems; - Py_ssize_t cur, i; + Py_ssize_t i; + size_t cur; /* protect against a[::-1] = a */ if (self == (PyListObject*)value) { -- cgit v0.12