Message 245670 - Python tracker

➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author	dev_zzo
Recipients	JohnLeitch, benjamin.peterson, dev_zzo
Date	2015-06-23.07:46:33
SpamBayes Score	-1.0
Marked as misclassified	Yes
Message-id	<1435045593.94.0.692563591611.issue24467@psf.upfronthosting.co.za>
In-reply-to

Content
Offending code in 2.7: https://hg.python.org/cpython/file/20c9290a5de4/Objects/bytearrayobject.c#l2381 https://hg.python.org/cpython/file/20c9290a5de4/Objects/bytearrayobject.c#l2412 Let n = 16, where = 0; memmove() then attempts to copy (n - where) = 16 bytes where it should have copied 15, since we drop one. This appears to be a typical case of off-by-one. Changing (n - where) to (n - where - 1) should fix the issue. This underfows when (where + 1) > n, but this case is guarded against in bytearray_pop() and cannot occur in bytearray_remove(). The exact same memmove() invocation code is found in all 3.x branches as well.

Offending code in 2.7:

https://hg.python.org/cpython/file/20c9290a5de4/Objects/bytearrayobject.c#l2381
https://hg.python.org/cpython/file/20c9290a5de4/Objects/bytearrayobject.c#l2412

Let n = 16, where = 0; memmove() then attempts to copy (n - where) = 16 bytes where it should have copied 15, since we drop one. This appears to be a typical case of off-by-one. Changing (n - where) to (n - where - 1) should fix the issue. This underfows when (where + 1) > n, but this case is guarded against in bytearray_pop() and cannot occur in bytearray_remove().

The exact same memmove() invocation code is found in all 3.x branches as well.

History
Date	User	Action	Args
2015-06-23 07:46:33	dev_zzo	set	recipients: + dev_zzo, benjamin.peterson, JohnLeitch
2015-06-23 07:46:33	dev_zzo	set	messageid: <1435045593.94.0.692563591611.issue24467@psf.upfronthosting.co.za>
2015-06-23 07:46:33	dev_zzo	link	issue24467 messages
2015-06-23 07:46:33	dev_zzo	create