diff Modules/arraymodule.c @ 48091:cc84ee6667b7 2.4

Backport r65182. This change modified from using the unsigned max value to the signed max value similar to 2.5 and trunk. Issue #2620: Overflow checking when allocating or reallocating memory was not always being done properly in some python types and extension modules. PyMem_MALLOC, PyMem_REALLOC, PyMem_NEW and PyMem_RESIZE have all been updated to perform better checks and places in the code that would previously leak memory on the error path when such an allocation failed have been fixed.
author Neal Norwitz <nnorwitz@gmail.com>
date Mon, 28 Jul 2008 05:22:45 +0000
parents 0565130d7d9f
children
line wrap: on
line diff
--- a/Modules/arraymodule.c	Tue Mar 11 18:01:21 2008 +0000
+++ b/Modules/arraymodule.c	Mon Jul 28 05:22:45 2008 +0000
@@ -814,6 +814,7 @@
 array_do_extend(arrayobject *self, PyObject *bb)
 {
 	int size;
+	char *old_item;
 
 	if (!array_Check(bb))
 		return array_iter_extend(self, bb);
@@ -829,10 +830,11 @@
 			return -1;
 	}
 	size = self->ob_size + b->ob_size;
+	old_item = self->ob_item;
         PyMem_RESIZE(self->ob_item, char, size*self->ob_descr->itemsize);
         if (self->ob_item == NULL) {
-                PyObject_Del(self);
-                PyErr_NoMemory();
+		self->ob_item = old_item;
+		PyErr_NoMemory();
 		return -1;
         }
 	memcpy(self->ob_item + self->ob_size*self->ob_descr->itemsize,
@@ -884,7 +886,7 @@
 			if (size > INT_MAX / n) {
 				return PyErr_NoMemory();
 			}
-			PyMem_Resize(items, char, n * size);
+			PyMem_RESIZE(items, char, n * size);
 			if (items == NULL)
 				return PyErr_NoMemory();
 			p = items;