[Python-checkins] r84715 - in python/branches/release31-maint: Misc/NEWS Objects/abstract.c

[benjamin.peterson]

Author: benjamin.peterson
Date: Sat Sep 11 18:03:33 2010
New Revision: 84715

Log:
Merged revisions 84714 via svnmerge from 
svn+ssh://pythondev@svn.python.org/python/branches/py3k

........
  r84714 | benjamin.peterson | 2010-09-11 11:02:03 -0500 (Sat, 11 Sep 2010) | 1 line
  
  check for NULL tp_as_mapping in PySequence_(Get/Set/Del)Slice #9834
........


Modified:
   python/branches/release31-maint/   (props changed)
   python/branches/release31-maint/Misc/NEWS
   python/branches/release31-maint/Objects/abstract.c

Modified: python/branches/release31-maint/Misc/NEWS
==============================================================================
--- python/branches/release31-maint/Misc/NEWS	(original)
+++ python/branches/release31-maint/Misc/NEWS	Sat Sep 11 18:03:33 2010
@@ -105,6 +105,10 @@
 C-API
 -----
 
+- Issue #9834: Don't segfault in PySequence_GetSlice, PySequence_SetSlice, or
+  PySequence_DelSlice when the object doesn't have any mapping operations
+  defined.
+
 - Issue #5753: A new C API function, :cfunc:`PySys_SetArgvEx`, allows
   embedders of the interpreter to set sys.argv without also modifying
   sys.path.  This helps fix `CVE-2008-5983

Modified: python/branches/release31-maint/Objects/abstract.c
==============================================================================
--- python/branches/release31-maint/Objects/abstract.c	(original)
+++ python/branches/release31-maint/Objects/abstract.c	Sat Sep 11 18:03:33 2010
@@ -1623,7 +1623,7 @@
     if (!s) return null_error();
 
     mp = s->ob_type->tp_as_mapping;
-    if (mp->mp_subscript) {
+    if (mp && mp->mp_subscript) {
         PyObject *res;
         PyObject *slice = _PySlice_FromIndices(i1, i2);
         if (!slice)
@@ -1701,7 +1701,7 @@
     }
 
     mp = s->ob_type->tp_as_mapping;
-    if (mp->mp_ass_subscript) {
+    if (mp && mp->mp_ass_subscript) {
         int res;
         PyObject *slice = _PySlice_FromIndices(i1, i2);
         if (!slice)
@@ -1726,7 +1726,7 @@
     }
 
     mp = s->ob_type->tp_as_mapping;
-    if (mp->mp_ass_subscript) {
+    if (mp && mp->mp_ass_subscript) {
         int res;
         PyObject *slice = _PySlice_FromIndices(i1, i2);
         if (!slice)