changeset:   84648:90109eaaf9e9
tag:         tip
user:        Victor Stinner <victor.stinner@gmail.com>
date:        Mon Jul 15 23:29:10 2013 +0200
files:       Objects/listobject.c
description:
Issue #18408: Fix list.pop()

list_ass_slice() now handles listresize() failure when items are deleted.


diff -r f35f82f47a2f -r 90109eaaf9e9 Objects/listobject.c
--- a/Objects/listobject.c	Mon Jul 15 19:46:22 2013 +0200
+++ b/Objects/listobject.c	Mon Jul 15 23:29:10 2013 +0200
@@ -644,9 +644,14 @@ list_ass_slice(PyListObject *a, Py_ssize
     memcpy(recycle, &item[ilow], s);
 
     if (d < 0) { /* Delete -d items */
-        memmove(&item[ihigh+d], &item[ihigh],
-            (Py_SIZE(a) - ihigh)*sizeof(PyObject *));
-        list_resize(a, Py_SIZE(a) + d);
+        Py_ssize_t tail;
+        tail = (Py_SIZE(a) - ihigh) * sizeof(PyObject *);
+        memmove(&item[ihigh+d], &item[ihigh], tail);
+        if (list_resize(a, Py_SIZE(a) + d) < 0) {
+            memmove(&item[ihigh], &item[ihigh+d], tail);
+            memcpy(&item[ilow], recycle, s);
+            goto Error;
+        }
         item = a->ob_item;
     }
     else if (d > 0) { /* Insert d items */
@@ -932,12 +937,10 @@ listpop(PyListObject *self, PyObject *ar
     }
     Py_INCREF(v);
     status = list_ass_slice(self, i, i+1, (PyObject *)NULL);
-    assert(status >= 0);
-    /* Use status, so that in a release build compilers don't
-     * complain about the unused name.
-     */
-    (void) status;
-
+    if (status < 0) {
+        Py_DECREF(v);
+        return NULL;
+    }
     return v;
 }