Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-04-22 03:41:08 +00:00
Code Issues Projects Releases Packages Wiki Activity

bpo-35091: Objects/listobject.c: Replace overflow checks in gallop fu… (GH-10202)

Browse source 
…nctions with asserts

The actual overflow can never happen because of the following:
* The size of a list can't be greater than PY_SSIZE_T_MAX / sizeof(PyObject*).
* The size of a pointer on all supported plaftorms is at least 4 bytes.
* ofs is positive and less than the list size at the beginning of each iteration.

https://bugs.python.org/issue35091
(cherry picked from commit 6bc5917903)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>
This commit is contained in:
Miss Islington (bot) 2019-05-22 17:18:55 -07:00 • committed by GitHub
parent b73c21c0be
commit 367fe5757a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Objects/listobject.c
View file

@ -1324,9 +1324,8 @@ gallop_left(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize_
while (ofs < maxofs) {
IFLT(a[ofs], key) {
lastofs = ofs;
assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2);
ofs = (ofs << 1) + 1;
if (ofs <= 0) /* int overflow */
ofs = maxofs;
}
else /* key <= a[hint + ofs] */
break;
@ -1347,9 +1346,8 @@ gallop_left(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize_
break;
/* key <= a[hint - ofs] */
lastofs = ofs;
assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2);
ofs = (ofs << 1) + 1;
if (ofs <= 0) /* int overflow */
ofs = maxofs;
}
if (ofs > maxofs)
ofs = maxofs;
@ -1415,9 +1413,8 @@ gallop_right(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize
while (ofs < maxofs) {
IFLT(key, *(a-ofs)) {
lastofs = ofs;
assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2);
ofs = (ofs << 1) + 1;
if (ofs <= 0) /* int overflow */
ofs = maxofs;
}
else /* a[hint - ofs] <= key */
break;
@ -1439,9 +1436,8 @@ gallop_right(MergeState *ms, PyObject *key, PyObject **a, Py_ssize_t n, Py_ssize
break;
/* a[hint + ofs] <= key */
lastofs = ofs;
assert(ofs <= (PY_SSIZE_T_MAX - 1) / 2);
ofs = (ofs << 1) + 1;
if (ofs <= 0) /* int overflow */
ofs = maxofs;
}
if (ofs > maxofs)
ofs = maxofs;