[Python-checkins] cpython (3.4): Issue #23985: Fixed integer overflow in iterator object. Patch by

[serhiy.storchaka]

https://hg.python.org/cpython/rev/5b86a1abc8c3
changeset:   96189:5b86a1abc8c3
branch:      3.4
parent:      96176:2c074a8dd084
user:        Serhiy Storchaka <storchaka at gmail.com>
date:        Thu May 21 20:50:25 2015 +0300
summary:
  Issue #23985: Fixed integer overflow in iterator object.  Patch by
Clement Rouault.

files:
  Lib/test/test_iter.py |  25 +++++++++++++++++++++++++
  Misc/ACKS             |   1 +
  Misc/NEWS             |   3 +++
  Objects/iterobject.c  |   5 +++++
  4 files changed, 34 insertions(+), 0 deletions(-)


diff --git a/Lib/test/test_iter.py b/Lib/test/test_iter.py
--- a/Lib/test/test_iter.py
+++ b/Lib/test/test_iter.py
@@ -1,5 +1,6 @@
 # Test iterators.
 
+import sys
 import unittest
 from test.support import run_unittest, TESTFN, unlink, cpython_only
 import pickle
@@ -48,6 +49,10 @@
         else:
             raise IndexError
 
+class UnlimitedSequenceClass:
+    def __getitem__(self, i):
+        return i
+
 # Main test suite
 
 class TestCase(unittest.TestCase):
@@ -919,6 +924,26 @@
         lst.extend(gen())
         self.assertEqual(len(lst), 760)
 
+    @cpython_only
+    def test_iter_overflow(self):
+        # Test for the issue 22939
+        it = iter(UnlimitedSequenceClass())
+        # Manually set `it_index` to PY_SSIZE_T_MAX-2 without a loop
+        it.__setstate__(sys.maxsize - 2)
+        self.assertEqual(next(it), sys.maxsize - 2)
+        self.assertEqual(next(it), sys.maxsize - 1)
+        with self.assertRaises(OverflowError):
+            next(it)
+        # Check that Overflow error is always raised
+        with self.assertRaises(OverflowError):
+            next(it)
+
+    def test_iter_neg_setstate(self):
+        it = iter(UnlimitedSequenceClass())
+        it.__setstate__(-42)
+        self.assertEqual(next(it), 0)
+        self.assertEqual(next(it), 1)
+
 
 def test_main():
     run_unittest(TestCase)
diff --git a/Misc/ACKS b/Misc/ACKS
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -1168,6 +1168,7 @@
 Just van Rossum
 Hugo van Rossum
 Saskia van Rossum
+Clement Rouault
 Donald Wallace Rouse II
 Liam Routt
 Todd Rovito
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@
 Core and Builtins
 -----------------
 
+- Issue #23985: Fixed integer overflow in iterator object.  Patch by
+  Clement Rouault.
+
 - Issue #23985: Fix a possible buffer overrun when deleting a slice from
   the front of a bytearray and then appending some other bytes data.
 
diff --git a/Objects/iterobject.c b/Objects/iterobject.c
--- a/Objects/iterobject.c
+++ b/Objects/iterobject.c
@@ -54,6 +54,11 @@
     seq = it->it_seq;
     if (seq == NULL)
         return NULL;
+    if (it->it_index == PY_SSIZE_T_MAX) {
+        PyErr_SetString(PyExc_OverflowError,
+                        "iter index too large");
+        return NULL;
+    }
 
     result = PySequence_GetItem(seq, it->it_index);
     if (result != NULL) {

-- 
Repository URL: https://hg.python.org/cpython