From e4ad37e50efadc319d6c1089222f552dfcbf76ee Mon Sep 17 00:00:00 2001 From: Antoine Pitrou Date: Thu, 1 Nov 2012 20:13:54 +0100 Subject: Issue #16230: Fix a crash in select.select() when one the lists changes size while iterated on. Patch by Serhiy Storchaka. --- Lib/test/test_select.py | 10 ++++++++++ Misc/NEWS | 3 +++ Modules/selectmodule.c | 6 ++---- 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/Lib/test/test_select.py b/Lib/test/test_select.py index fe92f45..4ddc217 100644 --- a/Lib/test/test_select.py +++ b/Lib/test/test_select.py @@ -49,6 +49,16 @@ class SelectTestCase(unittest.TestCase): self.fail('Unexpected return values from select():', rfd, wfd, xfd) p.close() + # Issue 16230: Crash on select resized list + def test_select_mutated(self): + a = [] + class F: + def fileno(self): + del a[-1] + return sys.__stdout__.fileno() + a[:] = [F()] * 10 + self.assertEqual(select.select([], a, []), ([], a[:5], [])) + def test_main(): support.run_unittest(SelectTestCase) support.reap_children() diff --git a/Misc/NEWS b/Misc/NEWS index 7ece312..4708e3f 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -143,6 +143,9 @@ Core and Builtins Library ------- +- Issue #16230: Fix a crash in select.select() when one the lists changes + size while iterated on. Patch by Serhiy Storchaka. + - Issue #16228: Fix a crash in the json module where a list changes size while it is being encoded. Patch by Serhiy Storchaka. diff --git a/Modules/selectmodule.c b/Modules/selectmodule.c index 98b3108..0736215 100644 --- a/Modules/selectmodule.c +++ b/Modules/selectmodule.c @@ -83,7 +83,7 @@ seq2set(PyObject *seq, fd_set *set, pylist fd2obj[FD_SETSIZE + 1]) { int max = -1; int index = 0; - Py_ssize_t i, len = -1; + Py_ssize_t i; PyObject* fast_seq = NULL; PyObject* o = NULL; @@ -94,9 +94,7 @@ seq2set(PyObject *seq, fd_set *set, pylist fd2obj[FD_SETSIZE + 1]) if (!fast_seq) return -1; - len = PySequence_Fast_GET_SIZE(fast_seq); - - for (i = 0; i < len; i++) { + for (i = 0; i < PySequence_Fast_GET_SIZE(fast_seq); i++) { SOCKET v; /* any intervening fileno() calls could decr this refcnt */ -- cgit v0.12