Fix for SF bug 571885

When resizing a tuple, zero out the memory starting at the end of the
old tuple not at the beginning of the old tuple.

diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index 525e8f6e63c78b8eee11d01625db24b3885a84c6..4c264fd46ff11c7ab38ebc865c9fab1c44d724e7 100644 (file)
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -696,8 +696,8 @@ _PyTuple_Resize(PyObject **pv, int newsize)
        _Py_NewReference((PyObject *) sv);
        /* Zero out items added by growing */
        if (newsize > oldsize)
-               memset(sv->ob_item, 0,
-                       sizeof(*sv->ob_item) * (newsize - oldsize));
+               memset(&sv->ob_item[oldsize], 0,
+                      sizeof(*sv->ob_item) * (newsize - oldsize));
        *pv = (PyObject *) sv;
        _PyObject_GC_TRACK(sv);
        return 0;