[Python-checkins] r77573 - in python/trunk: Include/bytearrayobject.h Lib/test/test_bytes.py Misc/NEWS Objects/bytearrayobject.c

[antoine.pitrou]

Author: antoine.pitrou
Date: Sun Jan 17 13:26:20 2010
New Revision: 77573

Log:
Issue #7561: Operations on empty bytearrays (such as `int(bytearray())`)
could crash in many places because of the PyByteArray_AS_STRING() macro
returning NULL.  The macro now returns a statically allocated empty
string instead.



Modified:
   python/trunk/Include/bytearrayobject.h
   python/trunk/Lib/test/test_bytes.py
   python/trunk/Misc/NEWS
   python/trunk/Objects/bytearrayobject.c

Modified: python/trunk/Include/bytearrayobject.h
==============================================================================
--- python/trunk/Include/bytearrayobject.h	(original)
+++ python/trunk/Include/bytearrayobject.h	Sun Jan 17 13:26:20 2010
@@ -44,9 +44,13 @@
 PyAPI_FUNC(int) PyByteArray_Resize(PyObject *, Py_ssize_t);
 
 /* Macros, trading safety for speed */
-#define PyByteArray_AS_STRING(self) (assert(PyByteArray_Check(self)),((PyByteArrayObject *)(self))->ob_bytes)
+#define PyByteArray_AS_STRING(self) \
+    (assert(PyByteArray_Check(self)), \
+     Py_SIZE(self) ? ((PyByteArrayObject *)(self))->ob_bytes : _PyByteArray_empty_string)
 #define PyByteArray_GET_SIZE(self)  (assert(PyByteArray_Check(self)),Py_SIZE(self))
 
+extern char _PyByteArray_empty_string[];
+
 #ifdef __cplusplus
 }
 #endif

Modified: python/trunk/Lib/test/test_bytes.py
==============================================================================
--- python/trunk/Lib/test/test_bytes.py	(original)
+++ python/trunk/Lib/test/test_bytes.py	Sun Jan 17 13:26:20 2010
@@ -783,6 +783,13 @@
         self.assertRaises(BufferError, delslice)
         self.assertEquals(b, orig)
 
+    def test_empty_bytearray(self):
+        # Issue #7561: operations on empty bytearrays could crash in many
+        # situations, due to a fragile implementation of the
+        # PyByteArray_AS_STRING() C macro.
+        self.assertRaises(ValueError, int, bytearray(b''))
+
+
 class AssortedBytesTest(unittest.TestCase):
     #
     # Test various combinations of bytes and bytearray

Modified: python/trunk/Misc/NEWS
==============================================================================
--- python/trunk/Misc/NEWS	(original)
+++ python/trunk/Misc/NEWS	Sun Jan 17 13:26:20 2010
@@ -12,6 +12,11 @@
 Core and Builtins
 -----------------
 
+- Issue #7561: Operations on empty bytearrays (such as `int(bytearray())`)
+  could crash in many places because of the PyByteArray_AS_STRING() macro
+  returning NULL.  The macro now returns a statically allocated empty
+  string instead.
+
 - Issue #7622: Improve the split(), rsplit(), splitlines() and replace()
   methods of bytes, bytearray and unicode objects by using a common
   implementation based on stringlib's fast search.  Patch by Florent Xicluna.

Modified: python/trunk/Objects/bytearrayobject.c
==============================================================================
--- python/trunk/Objects/bytearrayobject.c	(original)
+++ python/trunk/Objects/bytearrayobject.c	Sun Jan 17 13:26:20 2010
@@ -5,23 +5,16 @@
 #include "structmember.h"
 #include "bytes_methods.h"
 
-static PyByteArrayObject *nullbytes = NULL;
+char _PyByteArray_empty_string[] = "";
 
 void
 PyByteArray_Fini(void)
 {
-    Py_CLEAR(nullbytes);
 }
 
 int
 PyByteArray_Init(void)
 {
-    nullbytes = PyObject_New(PyByteArrayObject, &PyByteArray_Type);
-    if (nullbytes == NULL)
-        return 0;
-    nullbytes->ob_bytes = NULL;
-    Py_SIZE(nullbytes) = nullbytes->ob_alloc = 0;
-    nullbytes->ob_exports = 0;
     return 1;
 }
 
@@ -74,7 +67,7 @@
                 "accessing non-existent bytes segment");
         return -1;
     }
-    *ptr = (void *)self->ob_bytes;
+    *ptr = (void *)PyByteArray_AS_STRING(self);
     return Py_SIZE(self);
 }
 
@@ -86,7 +79,7 @@
                 "accessing non-existent bytes segment");
         return -1;
     }
-    *ptr = (void *)self->ob_bytes;
+    *ptr = (void *)PyByteArray_AS_STRING(self);
     return Py_SIZE(self);
 }
 
@@ -106,7 +99,7 @@
                 "accessing non-existent bytes segment");
         return -1;
     }
-    *ptr = self->ob_bytes;
+    *ptr = PyByteArray_AS_STRING(self);
     return Py_SIZE(self);
 }
 
@@ -119,10 +112,7 @@
                 obj->ob_exports++;
                 return 0;
         }
-        if (obj->ob_bytes == NULL)
-                ptr = "";
-        else
-                ptr = obj->ob_bytes;
+        ptr = (void *) PyByteArray_AS_STRING(obj);
         ret = PyBuffer_FillInfo(view, (PyObject*)obj, ptr, Py_SIZE(obj), 0, flags);
         if (ret >= 0) {
                 obj->ob_exports++;
@@ -201,7 +191,7 @@
             Py_DECREF(new);
             return PyErr_NoMemory();
         }
-        if (bytes != NULL)
+        if (bytes != NULL && size > 0)
             memcpy(new->ob_bytes, bytes, size);
         new->ob_bytes[size] = '\0';  /* Trailing null byte */
     }
@@ -1114,7 +1104,6 @@
 #define STRINGLIB_LEN PyByteArray_GET_SIZE
 #define STRINGLIB_STR PyByteArray_AS_STRING
 #define STRINGLIB_NEW PyByteArray_FromStringAndSize
-#define STRINGLIB_EMPTY nullbytes
 #define STRINGLIB_ISSPACE Py_ISSPACE
 #define STRINGLIB_ISLINEBREAK(x) ((x == '\n') || (x == '\r'))
 #define STRINGLIB_CHECK_EXACT PyByteArray_CheckExact