From fbb1c5ee068d209e33f6e15ecb4821d5d8b107fa Mon Sep 17 00:00:00 2001 From: Serhiy Storchaka Date: Wed, 30 Mar 2016 20:40:02 +0300 Subject: Issue #26494: Fixed crash on iterating exhausting iterators. Affected classes are generic sequence iterators, iterators of str, bytes, bytearray, list, tuple, set, frozenset, dict, OrderedDict, corresponding views and os.scandir() iterator. --- Objects/listobject.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) (limited to 'Objects/listobject.c') diff --git a/Objects/listobject.c b/Objects/listobject.c index eee7c68e9e..d688179d6b 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -2782,8 +2782,8 @@ listiter_next(listiterobject *it) return item; } - Py_DECREF(seq); it->it_seq = NULL; + Py_DECREF(seq); return NULL; } @@ -2912,9 +2912,17 @@ static PyObject * listreviter_next(listreviterobject *it) { PyObject *item; - Py_ssize_t index = it->it_index; - PyListObject *seq = it->it_seq; + Py_ssize_t index; + PyListObject *seq; + + assert(it != NULL); + seq = it->it_seq; + if (seq == NULL) { + return NULL; + } + assert(PyList_Check(seq)); + index = it->it_index; if (index>=0 && index < PyList_GET_SIZE(seq)) { item = PyList_GET_ITEM(seq, index); it->it_index--; @@ -2922,10 +2930,8 @@ listreviter_next(listreviterobject *it) return item; } it->it_index = -1; - if (seq != NULL) { - it->it_seq = NULL; - Py_DECREF(seq); - } + it->it_seq = NULL; + Py_DECREF(seq); return NULL; } -- cgit v1.2.1