diff options
author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2019-05-17 00:33:10 -0700 |
---|---|---|
committer | GitHub <noreply@github.com> | 2019-05-17 00:33:10 -0700 |
commit | f02d1a43c6be658cd279edb90e8e96c99e1127e7 (patch) | |
tree | c27f46c3ad004c5a96eeb1b498076dabd7788350 /Objects | |
parent | aa73841a8fdded4a462d045d1eb03899cbeecd65 (diff) | |
download | cpython-git-f02d1a43c6be658cd279edb90e8e96c99e1127e7.tar.gz |
bpo-36946: Fix possible signed integer overflow when handling slices. (GH-13375)
The final addition (cur += step) may overflow, so use size_t for "cur".
"cur" is always positive (even for negative steps), so it is safe to use
size_t here.
Co-Authored-By: Martin Panter <vadmium+py@gmail.com>
(cherry picked from commit 14514d9084a40f599c57da853a305aa264562a43)
Co-authored-by: Zackery Spytz <zspytz@gmail.com>
Diffstat (limited to 'Objects')
-rw-r--r-- | Objects/bytearrayobject.c | 3 | ||||
-rw-r--r-- | Objects/bytesobject.c | 3 | ||||
-rw-r--r-- | Objects/tupleobject.c | 3 | ||||
-rw-r--r-- | Objects/unicodeobject.c | 3 |
4 files changed, 8 insertions, 4 deletions
diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c index 3f3e6bcf0c..8a0994ffa4 100644 --- a/Objects/bytearrayobject.c +++ b/Objects/bytearrayobject.c @@ -420,7 +420,8 @@ bytearray_subscript(PyByteArrayObject *self, PyObject *index) return PyLong_FromLong((unsigned char)(PyByteArray_AS_STRING(self)[i])); } else if (PySlice_Check(index)) { - Py_ssize_t start, stop, step, slicelength, cur, i; + Py_ssize_t start, stop, step, slicelength, i; + size_t cur; if (PySlice_Unpack(index, &start, &stop, &step) < 0) { return NULL; } diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c index a5319da48d..b4ba1a01ab 100644 --- a/Objects/bytesobject.c +++ b/Objects/bytesobject.c @@ -1673,7 +1673,8 @@ bytes_subscript(PyBytesObject* self, PyObject* item) return PyLong_FromLong((unsigned char)self->ob_sval[i]); } else if (PySlice_Check(item)) { - Py_ssize_t start, stop, step, slicelength, cur, i; + Py_ssize_t start, stop, step, slicelength, i; + size_t cur; char* source_buf; char* result_buf; PyObject* result; diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c index 9bb91a5e65..7ee06e20e4 100644 --- a/Objects/tupleobject.c +++ b/Objects/tupleobject.c @@ -730,7 +730,8 @@ tuplesubscript(PyTupleObject* self, PyObject* item) return tupleitem(self, i); } else if (PySlice_Check(item)) { - Py_ssize_t start, stop, step, slicelength, cur, i; + Py_ssize_t start, stop, step, slicelength, i; + size_t cur; PyObject* result; PyObject* it; PyObject **src, **dest; diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index e18937981b..ed1e4a4dd5 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -13989,7 +13989,8 @@ unicode_subscript(PyObject* self, PyObject* item) i += PyUnicode_GET_LENGTH(self); return unicode_getitem(self, i); } else if (PySlice_Check(item)) { - Py_ssize_t start, stop, step, slicelength, cur, i; + Py_ssize_t start, stop, step, slicelength, i; + size_t cur; PyObject *result; void *src_data, *dest_data; int src_kind, dest_kind; |