[issue6540] bytearray.translate(): error in error handling

[STINNER Victor]

New submission from STINNER Victor <victor.stinner at haypocalc.com>:

bytearray.translate() crash if:
 * first argument was converted to a buffer but the buffer length is not 256
bytes
 * first argument is valid, but the second argument can not be converted to a
buffer

The crash occurs because PyBuffer_Release(&vdel) is called whereas vdel
buffer is not initialized.

Example with Python3:

lisa$ ./python
Python 3.2a0 (py3k:74029M, Jul 17 2009, 02:29:48)
[GCC 4.3.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> x=bytearray(b'xyz')
>>> x.translate(b'x', 1)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: translation table must be 256 characters long
>>> x.translate(b'x', 1)
Erreur de segmentation

Attached patch fixes the two cases and add an unit test for the first case. As
you can see in the example, it's an Heisenbug :-) (compile in debug bug to get
reproductible crash)

----------
components: Interpreter Core
files: bytearray.patch
keywords: patch
messages: 90786
nosy: haypo
severity: normal
status: open
title: bytearray.translate(): error in error handling
versions: Python 2.6, Python 2.7, Python 3.0, Python 3.1, Python 3.2
Added file: http://bugs.python.org/file14532/bytearray.patch

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue6540>
_______________________________________