Avoid seg fault if list object is modified during list.index

[ddorfman]

BPO	1005778
Files	listindex.diff: Diff against listobject.c and test case

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2004-08-13.03:19:25.000>
created_at = <Date 2004-08-09.05:34:08.000>
labels = ['interpreter-core']
title = 'Avoid seg fault if list object is modified during list.index'
updated_at = <Date 2004-08-13.03:19:25.000>
user = 'https://bugs.python.org/ddorfman'

bugs.python.org fields:

activity = <Date 2004-08-13.03:19:25.000>
actor = 'nnorwitz'
assignee = 'nnorwitz'
closed = True
closed_date = None
closer = None
components = ['Interpreter Core']
creation = <Date 2004-08-09.05:34:08.000>
creator = 'ddorfman'
dependencies = []
files = ['6159']
hgrepos = []
issue_num = 1005778
keywords = ['patch']
message_count = 2.0
messages = ['46589', '46590']
nosy_count = 2.0
nosy_names = ['nnorwitz', 'ddorfman']
pr_nums = []
priority = 'normal'
resolution = 'accepted'
stage = None
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue1005778'
versions = ['Python 2.4']

[ddorfman]

The list.index implementation can be coerced into indexing past
the end of ob_item. It calls PyObject_RichCompareBool (which
may call into Python) in a loop, but the loop counter is only
checked against a cached copy of the list size, so if the list
shrinks during the comparison, the next counter value may be out
of bounds. The patch includes a test case that causes unpatched
Pythons to seg fault.

I checked the other uses of PyObject_RichCompareBool in
listobject.c, and all of them look safe (but I mostly glossed over
the mergesort uses, which I'm sure have been painstakingly
verified and tested by its author).

(NB: The change to list_tests.py references the revision number of
the post-patch listobject.c. When this is committed, please make
sure that, that revision number is still current.)

[nnorwitz]

Logged In: YES
user_id=33168

Ouch, good catch. Thanks!

Checked in as:

• Objects/listobject.c 2.221
• Lib/test/list_tests.py 1.3
• Misc/NEWS 1.1086