diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2019-05-22 17:18:55 -0700 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-05-22 17:18:55 -0700 |
| commit | 367fe5757a707c4e3602dee807a9315199ed0b5c (patch) | |
| tree | efa5212fd4caec52007a8dbf6b21c92616c55807 /Objects | |
| parent | b73c21c0be7b42de6a88d67408249c8ec46e28f7 (diff) | |
| download | cpython-git-367fe5757a707c4e3602dee807a9315199ed0b5c.tar.gz | |
bpo-35091: Objects/listobject.c: Replace overflow checks in gallop fu… (GH-10202)
…nctions with asserts
The actual overflow can never happen because of the following:
* The size of a list can't be greater than PY_SSIZE_T_MAX / sizeof(PyObject*).
* The size of a pointer on all supported plaftorms is at least 4 bytes.
* ofs is positive and less than the list size at the beginning of each iteration.
https://bugs.python.org/issue35091
(cherry picked from commit 6bc5917903b722bdd0e5d3020949f26fec5dfe9a)
Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/listobject.c | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/Objects/listobject.c b/Objects/listobject.c index d795f66e6e..78aa8dea08 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -1324,9 +1324,8 @@ gallop_left(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize_ while (ofs < maxofs) { IFLT(a[ofs], key) { lastofs = ofs; + assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2); ofs = (ofs << 1) + 1; - if (ofs <= 0) /* int overflow */ - ofs = maxofs; } else /* key <= a[hint + ofs] */ break; @@ -1347,9 +1346,8 @@ gallop_left(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize_ break; /* key <= a[hint - ofs] */ lastofs = ofs; + assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2); ofs = (ofs << 1) + 1; - if (ofs <= 0) /* int overflow */ - ofs = maxofs; } if (ofs > maxofs) ofs = maxofs; @@ -1415,9 +1413,8 @@ gallop_right(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize while (ofs < maxofs) { IFLT(key, *(a-ofs)) { lastofs = ofs; + assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2); ofs = (ofs << 1) + 1; - if (ofs <= 0) /* int overflow */ - ofs = maxofs; } else /* a[hint - ofs] <= key */ break; @@ -1439,9 +1436,8 @@ gallop_right(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize break; /* a[hint + ofs] <= key */ lastofs = ofs; + assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2); ofs = (ofs << 1) + 1; - if (ofs <= 0) /* int overflow */ - ofs = maxofs; } if (ofs > maxofs) ofs = maxofs; |