Marc-Andre Lemburg <mal@lemburg.com>:

Fixed a bug in PyUnicode_Count() which would have caused a
core dump in case of substring coercion failure.

Synchronized .count() with the string method of the same name
to return len(s)+1 for s.count('').

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index e6d2a1a5f9b94f22de4fde7c1c2c8ae06d81776c..3157cd89c516aa0339efba516ba62cfd97744eae 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -2106,6 +2106,9 @@ int count(PyUnicodeObject *self,
 {
     int count = 0;
 
+    if (substring->length == 0)
+       return (end - start + 1);
+
     end -= substring->length;
 
     while (start <= end)
@@ -2130,7 +2133,7 @@ int PyUnicode_Count(PyObject *str,
        return -1;
     substr = PyUnicode_FromObject(substr);
     if (substr == NULL) {
-       Py_DECREF(substr);
+       Py_DECREF(str);
        return -1;
     }
     
@@ -3086,11 +3089,6 @@ unicode_count(PyUnicodeObject *self, PyObject *args)
     if (substring == NULL)
        return NULL;
     
-    if (substring->length == 0) {
-       Py_DECREF(substring);
-        return PyInt_FromLong((long) 0);
-    }
-
     if (start < 0)
         start += self->length;
     if (start < 0)