PyUnicode_Join(): Bozo Alert. While this is chugging along, it may

need to convert str objects from the iterable to unicode.  So, if
someone set the system default encoding to something nasty enough,
the conversion process could mutate the input iterable as a side
effect, and PySequence_Fast doesn't hide that from us if the input was
a list.  IOW, can't assume the size of PySequence_Fast's result is
invariant across PyUnicode_FromObject() calls.

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 668d239f353603a30216dc3456d7219d3eb4e5cf..f78788eb9adf5baa0de0990f34f7bf8ed458cdbd 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -4000,6 +4000,13 @@ PyUnicode_Join(PyObject *separator, PyObject *seq)
        return NULL;
     }
 
+    /* Grrrr.  A codec may be invoked to convert str objects to
+     * Unicode, and so it's possible to call back into Python code
+     * during PyUnicode_FromObject(), and so it's possible for a sick
+     * codec to change the size of fseq (if seq is a list).  Therefore
+     * we have to keep refetching the size -- can't assume seqlen
+     * is invariant.
+     */
     seqlen = PySequence_Fast_GET_SIZE(fseq);
     /* If empty sequence, return u"". */
     if (seqlen == 0) {
@@ -4029,6 +4036,8 @@ PyUnicode_Join(PyObject *separator, PyObject *seq)
                goto onError;
            sep = PyUnicode_AS_UNICODE(internal_separator);
            seplen = PyUnicode_GET_SIZE(internal_separator);
+           /* In case PyUnicode_FromObject() mutated seq. */
+           seqlen = PySequence_Fast_GET_SIZE(fseq);
         }
     }
 
@@ -4057,6 +4066,9 @@ PyUnicode_Join(PyObject *separator, PyObject *seq)
            goto onError;
        /* We own a reference to item from here on. */
 
+       /* In case PyUnicode_FromObject() mutated seq. */
+       seqlen = PySequence_Fast_GET_SIZE(fseq);
+
         /* Make sure we have enough space for the separator and the item. */
        itemlen = PyUnicode_GET_SIZE(item);
        new_res_used = res_used + itemlen;