From 95e22659639c544ad950d18346e02a919b9d1dd4 Mon Sep 17 00:00:00 2001
From: Moshe Zadka <moshez@math.huji.ac.il>
Date: Sat, 31 Mar 2001 06:48:52 +0000
Subject: - #122162 -- unicodeobject.c --- Fix unicode .split() off-by-one

- Loosely based on patch #103249 -- Fix core dumps in PyUnicode_Count
---
 Misc/NEWS               |  4 ++++
 Objects/stringobject.c  | 37 ++++++++++++++++++++++++++-----------
 Objects/unicodeobject.c | 13 ++++++++++++-
 3 files changed, 42 insertions(+), 12 deletions(-)

diff --git a/Misc/NEWS b/Misc/NEWS
index 8435758..2983297 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -64,6 +64,10 @@ http://sourceforge.net/tracker/index.php?func=detail&aid=<id>&group_id=5470&atid
   unbound methods to be reclaimed.  This plugs a large memory leak in a
   common Py_Initialize()/dosomething/Py_Finalize() loop.
 
+- #122162 -- unicodeobject.c --- Fix unicode .split() off-by-one
+
+- Loosely based on patch #103249 -- Fix core dumps in PyUnicode_Count
+
 What's New in Python 2.0?
 =========================
 
diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index 6ba907e..0c7a999 100644
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -1236,9 +1236,14 @@ string_count(PyStringObject *self, PyObject *args)
 		sub = PyString_AS_STRING(subobj);
 		n = PyString_GET_SIZE(subobj);
 	}
-	else if (PyUnicode_Check(subobj))
-		return PyInt_FromLong(
-		        PyUnicode_Count((PyObject *)self, subobj, i, last));
+	else if (PyUnicode_Check(subobj)) {
+		int count;
+		count = PyUnicode_Count((PyObject *)self, subobj, i, last);
+		if (count == -1)
+			return NULL;
+		else
+		    	return PyInt_FromLong((long) count);
+	}
 	else if (PyObject_AsCharBuffer(subobj, &sub, &n))
 		return NULL;
 
@@ -1637,10 +1642,15 @@ string_startswith(PyStringObject *self, PyObject *args)
 		prefix = PyString_AS_STRING(subobj);
 		plen = PyString_GET_SIZE(subobj);
 	}
-	else if (PyUnicode_Check(subobj))
-		return PyInt_FromLong(
-		        PyUnicode_Tailmatch((PyObject *)self, 
-					    subobj, start, end, -1));
+	else if (PyUnicode_Check(subobj)) {
+	    	int rc;
+		rc = PyUnicode_Tailmatch((PyObject *)self, 
+					  subobj, start, end, -1);
+		if (rc == -1)
+			return NULL;
+		else
+			return PyInt_FromLong((long) rc);
+	}
 	else if (PyObject_AsCharBuffer(subobj, &prefix, &plen))
 		return NULL;
 
@@ -1690,10 +1700,15 @@ string_endswith(PyStringObject *self, PyObject *args)
 		suffix = PyString_AS_STRING(subobj);
 		slen = PyString_GET_SIZE(subobj);
 	}
-	else if (PyUnicode_Check(subobj))
-		return PyInt_FromLong(
-		        PyUnicode_Tailmatch((PyObject *)self, 
-					    subobj, start, end, +1));
+	else if (PyUnicode_Check(subobj)) {
+	    	int rc;
+		rc = PyUnicode_Tailmatch((PyObject *)self, 
+					  subobj, start, end, +1);
+		if (rc == -1)
+			return NULL;
+		else
+			return PyInt_FromLong((long) rc);
+	}
 	else if (PyObject_AsCharBuffer(subobj, &suffix, &slen))
 		return NULL;
 
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index b31675b..cccdb16 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -2357,6 +2357,17 @@ int count(PyUnicodeObject *self,
 {
     int count = 0;
 
+    if (start < 0)
+        start += self->length;
+    if (start < 0)
+        start = 0;
+    if (end > self->length)
+        end = self->length;
+    if (end < 0)
+        end += self->length;
+    if (end < 0)
+        end = 0;
+
     if (substring->length == 0)
 	return (end - start + 1);
 
@@ -2925,7 +2936,7 @@ PyObject *split_substring(PyUnicodeObject *self,
     int sublen = substring->length;
     PyObject *str;
 
-    for (i = j = 0; i < len - sublen; ) {
+    for (i = j = 0; i <= len - sublen; ) {
 	if (Py_UNICODE_MATCH(self, i, substring)) {
 	    if (maxcount-- <= 0)
 		break;
-- 
cgit v0.12