mirror of
				https://github.com/python/cpython.git
				synced 2025-11-03 19:34:08 +00:00 
			
		
		
		
	Issue #9530: Fix a couple of places where undefined behaviour can
occur, as a result of signed integer overflow.
This commit is contained in:
		
							parent
							
								
									d0511b0efb
								
							
						
					
					
						commit
						7e3b948cfe
					
				
					 1 changed files with 8 additions and 2 deletions
				
			
		| 
						 | 
					@ -649,6 +649,11 @@ bytearray_ass_subscript(PyByteArrayObject *self, PyObject *index, PyObject *valu
 | 
				
			||||||
 | 
					
 | 
				
			||||||
            if (!_canresize(self))
 | 
					            if (!_canresize(self))
 | 
				
			||||||
                return -1;
 | 
					                return -1;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
					            if (slicelen == 0)
 | 
				
			||||||
 | 
					                /* Nothing to do here. */
 | 
				
			||||||
 | 
					                return 0;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
            if (step < 0) {
 | 
					            if (step < 0) {
 | 
				
			||||||
                stop = start + 1;
 | 
					                stop = start + 1;
 | 
				
			||||||
                start = stop + step * (slicelen - 1) - 1;
 | 
					                start = stop + step * (slicelen - 1) - 1;
 | 
				
			||||||
| 
						 | 
					@ -665,7 +670,7 @@ bytearray_ass_subscript(PyByteArrayObject *self, PyObject *index, PyObject *valu
 | 
				
			||||||
                        self->ob_bytes + cur + 1, lim);
 | 
					                        self->ob_bytes + cur + 1, lim);
 | 
				
			||||||
            }
 | 
					            }
 | 
				
			||||||
            /* Move the tail of the bytes, in one chunk */
 | 
					            /* Move the tail of the bytes, in one chunk */
 | 
				
			||||||
            cur = start + slicelen*step;
 | 
					            cur = start + (size_t)slicelen*step;
 | 
				
			||||||
            if (cur < (size_t)PyByteArray_GET_SIZE(self)) {
 | 
					            if (cur < (size_t)PyByteArray_GET_SIZE(self)) {
 | 
				
			||||||
                memmove(self->ob_bytes + cur - slicelen,
 | 
					                memmove(self->ob_bytes + cur - slicelen,
 | 
				
			||||||
                        self->ob_bytes + cur,
 | 
					                        self->ob_bytes + cur,
 | 
				
			||||||
| 
						 | 
					@ -679,7 +684,8 @@ bytearray_ass_subscript(PyByteArrayObject *self, PyObject *index, PyObject *valu
 | 
				
			||||||
        }
 | 
					        }
 | 
				
			||||||
        else {
 | 
					        else {
 | 
				
			||||||
            /* Assign slice */
 | 
					            /* Assign slice */
 | 
				
			||||||
            Py_ssize_t cur, i;
 | 
					            Py_ssize_t i;
 | 
				
			||||||
 | 
					            size_t cur;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
            if (needed != slicelen) {
 | 
					            if (needed != slicelen) {
 | 
				
			||||||
                PyErr_Format(PyExc_ValueError,
 | 
					                PyErr_Format(PyExc_ValueError,
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Loading…
	
	Add table
		Add a link
		
	
		Reference in a new issue