cpython: 9f2a1d9d7164 (original) (raw)

Mercurial > cpython

changeset 96190:9f2a1d9d7164

Issue #23985: Fixed integer overflow in iterator object. Patch by Clement Rouault. [#23985]

Serhiy Storchaka storchaka@gmail.com
date	Thu, 21 May 2015 20:51:53 +0300
parents	84d7ec21cc43(current diff)5b86a1abc8c3(diff)
children	f23533fa6afa
files	Misc/ACKS Misc/NEWS Objects/iterobject.c
diffstat	3 files changed, 33 insertions(+), 0 deletions(-)[+] [-] Lib/test/test_iter.py 25 Misc/NEWS 3 Objects/iterobject.c 5

line wrap: on

line diff

--- a/Lib/test/test_iter.py +++ b/Lib/test/test_iter.py @@ -1,5 +1,6 @@

Test iterators.

+import sys import unittest from test.support import run_unittest, TESTFN, unlink, cpython_only import pickle @@ -48,6 +49,10 @@ class SequenceClass: else: raise IndexError +class UnlimitedSequenceClass:

def getitem(self, i):
```
   return i[](#l1.16)
```

Main test suite

class TestCase(unittest.TestCase): @@ -919,6 +924,26 @@ class TestCase(unittest.TestCase): lst.extend(gen()) self.assertEqual(len(lst), 760)

@cpython_only
def test_iter_overflow(self):
```
   # Test for the issue 22939[](#l1.27)
```

   it = iter(UnlimitedSequenceClass())[](#l1.28)

   # Manually set `it_index` to PY_SSIZE_T_MAX-2 without a loop[](#l1.29)

   it.__setstate__(sys.maxsize - 2)[](#l1.30)

   self.assertEqual(next(it), sys.maxsize - 2)[](#l1.31)

   self.assertEqual(next(it), sys.maxsize - 1)[](#l1.32)

   with self.assertRaises(OverflowError):[](#l1.33)

```
       next(it)[](#l1.34)
```

   # Check that Overflow error is always raised[](#l1.35)

   with self.assertRaises(OverflowError):[](#l1.36)

```
       next(it)[](#l1.37)
```

def test_iter_neg_setstate(self):

   it = iter(UnlimitedSequenceClass())[](#l1.40)

```
   it.__setstate__(-42)[](#l1.41)
```

   self.assertEqual(next(it), 0)[](#l1.42)

   self.assertEqual(next(it), 1)[](#l1.43)

+ def test_main(): run_unittest(TestCase)

--- a/Misc/NEWS +++ b/Misc/NEWS @@ -10,6 +10,9 @@ Release date: 2015-05-24 Core and Builtins ----------------- +- Issue #23985: Fixed integer overflow in iterator object. Patch by

Clement Rouault. +

Issue #23985: Fix a possible buffer overrun when deleting a slice from the front of a bytearray and then appending some other bytes data.

--- a/Objects/iterobject.c +++ b/Objects/iterobject.c @@ -54,6 +54,11 @@ iter_iternext(PyObject *iterator) seq = it->it_seq; if (seq == NULL) return NULL;

if (it->it_index == PY_SSIZE_T_MAX) {

   PyErr_SetString(PyExc_OverflowError,[](#l4.8)

                   "iter index too large");[](#l4.9)

```
   return NULL;[](#l4.10)
```
}

result = PySequence_GetItem(seq, it->it_index); if (result != NULL) {