bpo-30255: Clip step in _PySlice_Unpack() (#1429)

In PySlice_IndicesEx, clip the step to [-PY_SSIZE_T_MAX,
PY_SSIZE_T_MAX] rather than [PY_SSIZE_T_MIN, PY_SSIZE_T_MAX].

(cherry picked from commit e6fc7401a92c7b51a80782d8095819b9909a0322)

diff --git a/Misc/NEWS b/Misc/NEWS
index b510725a5d6fe578dfb15bb9a329802af9baeb78..50a2c78ac9e725b6cdb2aaac23d3bdbbe210c818 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -932,6 +932,11 @@ Tools/Demos
 C API
 -----
 
+- bpo-30255: PySlice_GetIndicesEx now clips the step to
+  [-PY_SSIZE_T_MAX, PY_SSIZE_T_MAX] instead of
+  [-PY_SSIZE_T_MAX-1, PY_SSIZE_T_MAX].  This makes it safe to do "step = -step"
+  when reversing a slice.
+
 - Issue #26476: Fixed compilation error when use PyErr_BadInternalCall() in C++.
   Patch by Jeroen Demeyer.
 

diff --git a/Objects/sliceobject.c b/Objects/sliceobject.c
index 8f17fcacc81c7535242b728547d836cc87ba131e..64be9270386c1724e288c5d50f0a9de4e2381652 100644 (file)
--- a/Objects/sliceobject.c
+++ b/Objects/sliceobject.c
@@ -147,6 +147,13 @@ _PySlice_Unpack(PyObject *_r,
                             "slice step cannot be zero");
             return -1;
         }
+        /* Here *step might be -PY_SSIZE_T_MAX-1; in this case we replace it
+         * with -PY_SSIZE_T_MAX.  This doesn't affect the semantics, and it
+         * guards against later undefined behaviour resulting from code that
+         * does "step = -step" as part of a slice reversal.
+         */
+        if (*step < -PY_SSIZE_T_MAX)
+            *step = -PY_SSIZE_T_MAX;
     }
 
     if (r->start == Py_None) {