Message148517
The mid index computation in _bisectmodule.c in both internal_bisect_right and internal_bisect_left is done with:
mid = (lo + hi) / 2; // all three variables Py_ssize_t
which is susceptible to overflows for large arrays, which would lead to undefined behavior (and in practice almost certainly a crash with a negative index)
The fix is trivial - mid = lo + (hi - lo) / 2; - but since I'm just starting to look into the code base I may be missing some undocumented assertions that guarantee this can't happen. |
|
Date |
User |
Action |
Args |
2011-11-28 22:34:32 | Voo | set | recipients:
+ Voo |
2011-11-28 22:34:32 | Voo | set | messageid: <1322519672.22.0.173147243777.issue13496@psf.upfronthosting.co.za> |
2011-11-28 22:34:31 | Voo | link | issue13496 messages |
2011-11-28 22:34:31 | Voo | create | |
|