Fix an out-of-bound index in pmerge() discovered by Zooko (SF bug

645404).  I'm not 100% sure this is the right fix, so I'll keep the
bug report open for Samuele, but this fixes the index error and passes
the test suite (and I can't see why it *shouldn't* be the right fix
:-).

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 45a229a9d9a198607289042a587f1f23dd302044..f05cf7c97ce2614e2169829fc9a1cdab4920e3dd 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -1067,7 +1067,8 @@ pmerge(PyObject *acc, PyObject* to_merge) {
                }
                for (j = 0; j < to_merge_size; j++) {
                        PyObject *j_lst = PyList_GET_ITEM(to_merge, j);
-                       if (PyList_GET_ITEM(j_lst, remain[j]) == candidate) {
+                       if (remain[j] < PyList_GET_SIZE(j_lst) &&
+                           PyList_GET_ITEM(j_lst, remain[j]) == candidate) {
                                remain[j]++;
                        }
                }