Merged revisions 84714 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/branches/py3k

........
  r84714 | benjamin.peterson | 2010-09-11 11:02:03 -0500 (Sat, 11 Sep 2010) | 1 line

  check for NULL tp_as_mapping in PySequence_(Get/Set/Del)Slice #9834
........

diff --git a/Misc/NEWS b/Misc/NEWS
index d716e47de8529108113e2e0cc7d087a9a7867de3..327186173ed22528939a94362aabee8fcb99a456 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -105,6 +105,10 @@ Core and Builtins
 C-API
 -----
 
+- Issue #9834: Don't segfault in PySequence_GetSlice, PySequence_SetSlice, or
+  PySequence_DelSlice when the object doesn't have any mapping operations
+  defined.
+
 - Issue #5753: A new C API function, :cfunc:`PySys_SetArgvEx`, allows
   embedders of the interpreter to set sys.argv without also modifying
   sys.path.  This helps fix `CVE-2008-5983

diff --git a/Objects/abstract.c b/Objects/abstract.c
index 3698250bcb4a6ba4f34c1b1b4dc55ba7102a07b5..2d4f2e1772d9a735465ec8110bb2fe8634b1d484 100644 (file)
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -1623,7 +1623,7 @@ PySequence_GetSlice(PyObject *s, Py_ssize_t i1, Py_ssize_t i2)
     if (!s) return null_error();
 
     mp = s->ob_type->tp_as_mapping;
-    if (mp->mp_subscript) {
+    if (mp && mp->mp_subscript) {
         PyObject *res;
         PyObject *slice = _PySlice_FromIndices(i1, i2);
         if (!slice)
@@ -1701,7 +1701,7 @@ PySequence_SetSlice(PyObject *s, Py_ssize_t i1, Py_ssize_t i2, PyObject *o)
     }
 
     mp = s->ob_type->tp_as_mapping;
-    if (mp->mp_ass_subscript) {
+    if (mp && mp->mp_ass_subscript) {
         int res;
         PyObject *slice = _PySlice_FromIndices(i1, i2);
         if (!slice)
@@ -1726,7 +1726,7 @@ PySequence_DelSlice(PyObject *s, Py_ssize_t i1, Py_ssize_t i2)
     }
 
     mp = s->ob_type->tp_as_mapping;
-    if (mp->mp_ass_subscript) {
+    if (mp && mp->mp_ass_subscript) {
         int res;
         PyObject *slice = _PySlice_FromIndices(i1, i2);
         if (!slice)