[Python-checkins] cpython (merge 3.4 -> default): Issue #23985: Fixed integer overflow in iterator object. Patch by

Thu May 21 19:52:26 CEST 2015

https://hg.python.org/cpython/rev/9f2a1d9d7164
changeset: 96190:9f2a1d9d7164
parent: 96187:84d7ec21cc43
parent: 96189:5b86a1abc8c3
user: Serhiy Storchaka <storchaka at gmail.com>
date: Thu May 21 20:51:53 2015 +0300
summary:
 Issue #23985: Fixed integer overflow in iterator object. Patch by
Clement Rouault.
files:
 Lib/test/test_iter.py | 25 +++++++++++++++++++++++++
 Misc/NEWS | 3 +++
 Objects/iterobject.c | 5 +++++
 3 files changed, 33 insertions(+), 0 deletions(-)

diff --git a/Lib/test/test_iter.py b/Lib/test/test_iter.py
--- a/Lib/test/test_iter.py
+++ b/Lib/test/test_iter.py
@@ -1,5 +1,6 @@
 # Test iterators.
 
+import sys
 import unittest
 from test.support import run_unittest, TESTFN, unlink, cpython_only
 import pickle
@@ -48,6 +49,10 @@
 else:
 raise IndexError
 
+class UnlimitedSequenceClass:
+ def __getitem__(self, i):
+ return i
+
 # Main test suite
 
 class TestCase(unittest.TestCase):
@@ -919,6 +924,26 @@
 lst.extend(gen())
 self.assertEqual(len(lst), 760)
 
+ @cpython_only
+ def test_iter_overflow(self):
+ # Test for the issue 22939
+ it = iter(UnlimitedSequenceClass())
+ # Manually set `it_index` to PY_SSIZE_T_MAX-2 without a loop
+ it.__setstate__(sys.maxsize - 2)
+ self.assertEqual(next(it), sys.maxsize - 2)
+ self.assertEqual(next(it), sys.maxsize - 1)
+ with self.assertRaises(OverflowError):
+ next(it)
+ # Check that Overflow error is always raised
+ with self.assertRaises(OverflowError):
+ next(it)
+
+ def test_iter_neg_setstate(self):
+ it = iter(UnlimitedSequenceClass())
+ it.__setstate__(-42)
+ self.assertEqual(next(it), 0)
+ self.assertEqual(next(it), 1)
+
 
 def test_main():
 run_unittest(TestCase)
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@
 Core and Builtins
 -----------------
 
+- Issue #23985: Fixed integer overflow in iterator object. Patch by
+ Clement Rouault.
+
 - Issue #23985: Fix a possible buffer overrun when deleting a slice from
 the front of a bytearray and then appending some other bytes data.
 
diff --git a/Objects/iterobject.c b/Objects/iterobject.c
--- a/Objects/iterobject.c
+++ b/Objects/iterobject.c
@@ -54,6 +54,11 @@
 seq = it->it_seq;
 if (seq == NULL)
 return NULL;
+ if (it->it_index == PY_SSIZE_T_MAX) {
+ PyErr_SetString(PyExc_OverflowError,
+ "iter index too large");
+ return NULL;
+ }
 
 result = PySequence_GetItem(seq, it->it_index);
 if (result != NULL) {
-- 
Repository URL: https://hg.python.org/cpython
