Author dev_zzo
Recipients JohnLeitch, benjamin.peterson, dev_zzo
Date 2015-06-23.07:46:33
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1435045593.94.0.692563591611.issue24467@psf.upfronthosting.co.za>
In-reply-to
Content
Offending code in 2.7:

https://hg.python.org/cpython/file/20c9290a5de4/Objects/bytearrayobject.c#l2381
https://hg.python.org/cpython/file/20c9290a5de4/Objects/bytearrayobject.c#l2412

Let n = 16, where = 0; memmove() then attempts to copy (n - where) = 16 bytes where it should have copied 15, since we drop one. This appears to be a typical case of off-by-one. Changing (n - where) to (n - where - 1) should fix the issue. This underfows when (where + 1) > n, but this case is guarded against in bytearray_pop() and cannot occur in bytearray_remove().

The exact same memmove() invocation code is found in all 3.x branches as well.
History
Date User Action Args
2015-06-23 07:46:33dev_zzosetrecipients: + dev_zzo, benjamin.peterson, JohnLeitch
2015-06-23 07:46:33dev_zzosetmessageid: <1435045593.94.0.692563591611.issue24467@psf.upfronthosting.co.za>
2015-06-23 07:46:33dev_zzolinkissue24467 messages
2015-06-23 07:46:33dev_zzocreate