(original) (raw)

changeset: 103290:d465da1e5902 branch: 2.7 user: Martin Panter vadmium+py@gmail.com date: Wed Sep 07 11:04:41 2016 +0000 files: Lib/test/test_array.py Misc/NEWS Modules/_ctypes/_ctypes.c Modules/_ctypes/stgdict.c Modules/arraymodule.c description: Issue #27570: Avoid zero-length memcpy() calls with null source pointers diff -r 731e5617cc8d -r d465da1e5902 Lib/test/test_array.py --- a/Lib/test/test_array.py Wed Sep 07 22:26:08 2016 -0700 +++ b/Lib/test/test_array.py Wed Sep 07 11:04:41 2016 +0000 @@ -22,9 +22,9 @@ if test_support.have_unicode: typecodes += "u" -class BadConstructorTest(unittest.TestCase): +class MiscTest(unittest.TestCase): - def test_constructor(self): + def test_bad_constructor(self): self.assertRaises(TypeError, array.array) self.assertRaises(TypeError, array.array, spam=42) self.assertRaises(TypeError, array.array, 'xx') @@ -40,7 +40,17 @@ self.assertRaises(ValueError, array.array, u'x') self.assertRaises(ValueError, array.array, u'\x80') -tests.append(BadConstructorTest) + def test_empty(self): + # Exercise code for handling zero-length arrays + a = array.array('B') + a[:] = a + self.assertEqual(len(a), 0) + self.assertEqual(len(a + a), 0) + self.assertEqual(len(a * 3), 0) + a += a + self.assertEqual(len(a), 0) + +tests.append(MiscTest) class BaseTest(unittest.TestCase): # Required class attributes (provided by subclasses diff -r 731e5617cc8d -r d465da1e5902 Misc/NEWS --- a/Misc/NEWS Wed Sep 07 22:26:08 2016 -0700 +++ b/Misc/NEWS Wed Sep 07 11:04:41 2016 +0000 @@ -40,6 +40,9 @@ Library ------- +- Issue #27570: Avoid zero-length memcpy() etc calls with null source + pointers in the "ctypes" and "array" modules. + - lib2to3.pgen3.driver.load_grammar() now creates a stable cache file between runs given the same Grammar.txt input regardless of the hash randomization setting. diff -r 731e5617cc8d -r d465da1e5902 Modules/_ctypes/_ctypes.c --- a/Modules/_ctypes/_ctypes.c Wed Sep 07 22:26:08 2016 -0700 +++ b/Modules/_ctypes/_ctypes.c Wed Sep 07 11:04:41 2016 +0000 @@ -1426,8 +1426,10 @@ return NULL; } stgdict->shape[0] = length; - memmove(&stgdict->shape[1], itemdict->shape, - sizeof(Py_ssize_t) * (stgdict->ndim - 1)); + if (stgdict->ndim > 1) { + memmove(&stgdict->shape[1], itemdict->shape, + sizeof(Py_ssize_t) * (stgdict->ndim - 1)); + } itemsize = itemdict->size; if (length * itemsize < 0) { diff -r 731e5617cc8d -r d465da1e5902 Modules/_ctypes/stgdict.c --- a/Modules/_ctypes/stgdict.c Wed Sep 07 22:26:08 2016 -0700 +++ b/Modules/_ctypes/stgdict.c Wed Sep 07 11:04:41 2016 +0000 @@ -395,9 +395,11 @@ } memset(stgdict->ffi_type_pointer.elements, 0, sizeof(ffi_type *) * (basedict->length + len + 1)); - memcpy(stgdict->ffi_type_pointer.elements, - basedict->ffi_type_pointer.elements, - sizeof(ffi_type *) * (basedict->length)); + if (basedict->length > 0) { + memcpy(stgdict->ffi_type_pointer.elements, + basedict->ffi_type_pointer.elements, + sizeof(ffi_type *) * (basedict->length)); + } ffi_ofs = basedict->length; } else { offset = 0; diff -r 731e5617cc8d -r d465da1e5902 Modules/arraymodule.c --- a/Modules/arraymodule.c Wed Sep 07 22:26:08 2016 -0700 +++ b/Modules/arraymodule.c Wed Sep 07 11:04:41 2016 +0000 @@ -620,8 +620,10 @@ np = (arrayobject *) newarrayobject(&Arraytype, ihigh - ilow, a->ob_descr); if (np == NULL) return NULL; - memcpy(np->ob_item, a->ob_item + ilow * a->ob_descr->itemsize, - (ihigh-ilow) * a->ob_descr->itemsize); + if (ihigh > ilow) { + memcpy(np->ob_item, a->ob_item + ilow * a->ob_descr->itemsize, + (ihigh-ilow) * a->ob_descr->itemsize); + } return (PyObject *)np; } @@ -660,9 +662,13 @@ if (np == NULL) { return NULL; } - memcpy(np->ob_item, a->ob_item, Py_SIZE(a)*a->ob_descr->itemsize); - memcpy(np->ob_item + Py_SIZE(a)*a->ob_descr->itemsize, - b->ob_item, Py_SIZE(b)*b->ob_descr->itemsize); + if (Py_SIZE(a) > 0) { + memcpy(np->ob_item, a->ob_item, Py_SIZE(a)*a->ob_descr->itemsize); + } + if (Py_SIZE(b) > 0) { + memcpy(np->ob_item + Py_SIZE(a)*a->ob_descr->itemsize, + b->ob_item, Py_SIZE(b)*b->ob_descr->itemsize); + } return (PyObject *)np; #undef b } @@ -684,6 +690,8 @@ np = (arrayobject *) newarrayobject(&Arraytype, size, a->ob_descr); if (np == NULL) return NULL; + if (size == 0) + return (PyObject *)np; p = np->ob_item; nbytes = Py_SIZE(a) * a->ob_descr->itemsize; for (i = 0; i < n; i++) { @@ -838,8 +846,10 @@ PyErr_NoMemory(); return -1; } - memcpy(self->ob_item + Py_SIZE(self)*self->ob_descr->itemsize, - b->ob_item, Py_SIZE(b)*b->ob_descr->itemsize); + if (Py_SIZE(b) > 0) { + memcpy(self->ob_item + Py_SIZE(self)*self->ob_descr->itemsize, + b->ob_item, Py_SIZE(b)*b->ob_descr->itemsize); + } Py_SIZE(self) = size; self->allocated = size; /vadmium+py@gmail.com