Closes: #556025 seg fault when doing list(xrange(1e9))

A MemoryError is now raised when the list cannot be created.
There is a test, but as the comment says, it really only
works for 32 bit systems.  I don't know how to improve
the test for other systems (ie, 64 bit or systems
where the data size != addressable size,
e.g. 64 bit data, but 48 bit addressable memory)

diff --git a/Lib/test/test_b1.py b/Lib/test/test_b1.py
index 554e350fda289a4e154fd9d4dbe945ff2f994918..56a5f783c4e1a000f6201930c2f158553cb59d31 100644 (file)
--- a/Lib/test/test_b1.py
+++ b/Lib/test/test_b1.py
@@ -514,6 +514,17 @@ if list((0, 1, 2, 3)) != [0, 1, 2, 3]: raise TestFailed, 'list((0, 1, 2, 3))'
 if list('') != []: raise TestFailed, 'list('')'
 if list('spam') != ['s', 'p', 'a', 'm']: raise TestFailed, "list('spam')"
 
+try:
+    # Verify clearing of bug #556025
+    # this assumes that the max data size (sys.maxint) == max address size
+    # this also assumes that the address size is at least 4 bytes
+    # with 8 byte addresses, the bug is not well tested
+    list(xrange(sys.maxint / 4))
+except MemoryError:
+    pass
+else:
+    raise TestFailed, 'list(xrange(sys.maxint / 4))'
+
 print 'long'
 if long(314) != 314L: raise TestFailed, 'long(314)'
 if long(3.14) != 3L: raise TestFailed, 'long(3.14)'

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 449651576fcbaca544e43b936d828b00a2514db9..83a8c70bdea88db6bcdf172ad73fa3bb0bc1698d 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -44,7 +44,14 @@ roundupsize(int n)
        return ((n >> nbits) + 1) << nbits;
  }
 
-#define NRESIZE(var, type, nitems) PyMem_RESIZE(var, type, roundupsize(nitems))
+#define NRESIZE(var, type, nitems)                             \
+do {                                                           \
+       size_t _new_size = roundupsize(nitems);                 \
+       if (_new_size <= ((~(size_t)0) / sizeof(type)))         \
+               PyMem_RESIZE(var, type, _new_size);             \
+       else                                                    \
+               var = NULL;                                     \
+} while (0)
 
 PyObject *
 PyList_New(int size)
@@ -1565,8 +1572,10 @@ list_fill(PyListObject *result, PyObject *v)
        if (n < 0)
                n = 8;  /* arbitrary */
        NRESIZE(result->ob_item, PyObject*, n);
-       if (result->ob_item == NULL)
+       if (result->ob_item == NULL) {
+               PyErr_NoMemory();
                goto error;
+       }
        for (i = 0; i < n; i++)
                result->ob_item[i] = NULL;
        result->ob_size = n;