From: Guido van Rossum <guido@python.org>
Date: Tue, 31 Dec 2002 16:33:01 +0000 (+0000)
Subject: Fix an out-of-bound index in pmerge() discovered by Zooko (SF bug
X-Git-Tag: v2.3c1~2711
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=768158c11b0ad571b7e6c9337aa39bae4b3958e3;p=python

Fix an out-of-bound index in pmerge() discovered by Zooko (SF bug
645404).  I'm not 100% sure this is the right fix, so I'll keep the
bug report open for Samuele, but this fixes the index error and passes
the test suite (and I can't see why it *shouldn't* be the right fix
:-).
---

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 45a229a9d9..f05cf7c97c 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -1067,7 +1067,8 @@ pmerge(PyObject *acc, PyObject* to_merge) {
 		}
 		for (j = 0; j < to_merge_size; j++) {
 			PyObject *j_lst = PyList_GET_ITEM(to_merge, j);
-			if (PyList_GET_ITEM(j_lst, remain[j]) == candidate) {
+			if (remain[j] < PyList_GET_SIZE(j_lst) &&
+			    PyList_GET_ITEM(j_lst, remain[j]) == candidate) {
 				remain[j]++;
 			}
 		}