Issue #23349: Fix off-by-one error in PyBuffer_ToContiguous(). Initial patch

by Richard Hansen.

diff --git a/Misc/ACKS b/Misc/ACKS
index c50f76e973e46558a2f31ae9a02e58d871084a95..f03f34ea05138e883e59dd0e29df003e9f551428 100644 (file)
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -518,6 +518,7 @@ Mark Hammond
 Harald Hanche-Olsen
 Manus Hand
 Milton L. Hankins
+Richard Hansen
 Stephen Hansen
 Barry Hantman
 Lynda Hardman

diff --git a/Modules/_testcapimodule.c b/Modules/_testcapimodule.c
index e4885d187feded1d4032f4f4d05ba61dcc689ae9..31f3a1762d00ef9297b9ea8b98789820ce03700b 100644 (file)
--- a/Modules/_testcapimodule.c
+++ b/Modules/_testcapimodule.c
@@ -376,6 +376,53 @@ test_broken_memoryview(PyObject* self)
     Py_RETURN_NONE;
 }
 
+static PyObject *
+test_to_contiguous(PyObject* self, PyObject *noargs)
+{
+    int data[9] = {0, -1, 1, -1, 2, -1,  3, -1, 4};
+    int result[5];
+    Py_ssize_t itemsize = sizeof(int);
+    Py_ssize_t shape = 5;
+    Py_ssize_t strides = 2 * itemsize;
+    Py_buffer view = {
+        data,
+        NULL,
+        5 * itemsize,
+        itemsize,
+        1,
+        1,
+        NULL,
+        &shape,
+        &strides,
+        NULL,
+        {0, 0},
+        NULL
+    };
+    int i;
+
+    PyBuffer_ToContiguous(result, &view, view.len, 'C');
+    for (i = 0; i < 5; i++) {
+        if (result[i] != i) {
+            PyErr_SetString(TestError,
+                "test_to_contiguous: incorrect result");
+            return NULL;
+        }
+    }
+
+    view.buf = &data[8];
+    view.strides[0] = -2 * itemsize;
+
+    PyBuffer_ToContiguous(result, &view, view.len, 'C');
+    for (i = 0; i < 5; i++) {
+        if (result[i] != 4-i) {
+            PyErr_SetString(TestError,
+                "test_to_contiguous: incorrect result");
+            return NULL;
+        }
+    }
+
+    Py_RETURN_NONE;
+}
 
 /* Tests of PyLong_{As, From}{Unsigned,}Long(), and (#ifdef HAVE_LONG_LONG)
    PyLong_{As, From}{Unsigned,}LongLong().
@@ -1785,6 +1832,7 @@ static PyMethodDef TestMethods[] = {
     {"test_dict_iteration",     (PyCFunction)test_dict_iteration,METH_NOARGS},
     {"test_lazy_hash_inheritance",      (PyCFunction)test_lazy_hash_inheritance,METH_NOARGS},
     {"test_broken_memoryview",          (PyCFunction)test_broken_memoryview,METH_NOARGS},
+    {"test_to_contiguous",      (PyCFunction)test_to_contiguous, METH_NOARGS},
     {"test_long_api",           (PyCFunction)test_long_api,      METH_NOARGS},
     {"test_long_and_overflow", (PyCFunction)test_long_and_overflow,
      METH_NOARGS},

diff --git a/Objects/abstract.c b/Objects/abstract.c
index 5707eb2b8833c70c953b1711592246b1546b2d15..83a48bab70133268ae87d9089dd85caecf2b1a08 100644 (file)
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -499,7 +499,7 @@ PyBuffer_ToContiguous(void *buf, Py_buffer *view, Py_ssize_t len, char fort)
 
     /* Otherwise a more elaborate scheme is needed */
 
-    /* XXX(nnorwitz): need to check for overflow! */
+    /* view->ndim <= 64 */
     indices = (Py_ssize_t *)PyMem_Malloc(sizeof(Py_ssize_t)*(view->ndim));
     if (indices == NULL) {
         PyErr_NoMemory();
@@ -521,10 +521,10 @@ PyBuffer_ToContiguous(void *buf, Py_buffer *view, Py_ssize_t len, char fort)
      */
     elements = len / view->itemsize;
     while (elements--) {
-        addone(view->ndim, indices, view->shape);
         ptr = PyBuffer_GetPointer(view, indices);
         memcpy(dest, ptr, view->itemsize);
         dest += view->itemsize;
+        addone(view->ndim, indices, view->shape);
     }
     PyMem_Free(indices);
     return 0;