SF patch #1005778, Fix seg fault if list object is modified during list.index()

Backport candidate

diff --git a/Lib/test/list_tests.py b/Lib/test/list_tests.py
index d20d198c58db8d6cb21d18e17cfaf43817db2432..1233ad1479a14404b13b31b2518dcce8fcf23cd5 100644 (file)
--- a/Lib/test/list_tests.py
+++ b/Lib/test/list_tests.py
@@ -311,6 +311,18 @@ class CommonTest(seq_tests.CommonTest):
         self.assertRaises(ValueError, a.index, 2, 0, 4)
         self.assertEqual(a, self.type2test([-2, -1, 0, 1, 2]))
 
+        # Test modifying the list during index's iteration
+        class EvilCmp:
+            def __init__(self, victim):
+                self.victim = victim
+            def __eq__(self, other):
+                del self.victim[:]
+                return False
+        a = self.type2test()
+        a[:] = [EvilCmp(a) for _ in xrange(100)]
+        # This used to seg fault before patch #1005778
+        self.assertRaises(ValueError, a.index, None)
+
     def test_reverse(self):
         u = self.type2test([-2, -1, 0, 1, 2])
         u2 = u[:]

diff --git a/Misc/NEWS b/Misc/NEWS
index c4a1cf17738af377ea6c860ec071f2aef702bdb7..c1c78677ec871bbf0f4dc21b595f291b5d85c4b9 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,10 @@ What's New in Python 2.4 alpha 3?
 Core and builtins
 -----------------
 
+- SF patch #1005778.  Fix a seg fault if the list size changed while
+  calling list.index().  This could happen if a rich comparison function
+  modified the list.
+
 - The ``func_name`` (a.k.a. ``__name__``) attribute of user-defined
   functions is now writable.
 

diff --git a/Objects/listobject.c b/Objects/listobject.c
index e5d5b2579e80fc703328865fccc28ad9a42bfec3..89cedc9bfa556b2342ebd7ff7dba8271f48ba50e 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -2186,9 +2186,7 @@ listindex(PyListObject *self, PyObject *args)
                if (stop < 0)
                        stop = 0;
        }
-       else if (stop > self->ob_size)
-               stop = self->ob_size;
-       for (i = start; i < stop; i++) {
+       for (i = start; i < stop && i < self->ob_size; i++) {
                int cmp = PyObject_RichCompareBool(self->ob_item[i], v, Py_EQ);
                if (cmp > 0)
                        return PyInt_FromLong((long)i);