This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author vstinner
Recipients vstinner
Date 2009-07-22.00:14:49
SpamBayes Score 1.2989609e-14
Marked as misclassified No
Message-id <1248221692.97.0.916983162972.issue6540@psf.upfronthosting.co.za>
In-reply-to
Content
bytearray.translate() crash if:
 * first argument was converted to a buffer but the buffer length is not 256
bytes
 * first argument is valid, but the second argument can not be converted to a
buffer

The crash occurs because PyBuffer_Release(&vdel) is called whereas vdel
buffer is not initialized.

Example with Python3:

lisa$ ./python
Python 3.2a0 (py3k:74029M, Jul 17 2009, 02:29:48)
[GCC 4.3.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> x=bytearray(b'xyz')
>>> x.translate(b'x', 1)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: translation table must be 256 characters long
>>> x.translate(b'x', 1)
Erreur de segmentation

Attached patch fixes the two cases and add an unit test for the first case. As
you can see in the example, it's an Heisenbug :-) (compile in debug bug to get
reproductible crash)
History
Date User Action Args
2009-07-22 00:14:53vstinnersetrecipients: + vstinner
2009-07-22 00:14:52vstinnersetmessageid: <1248221692.97.0.916983162972.issue6540@psf.upfronthosting.co.za>
2009-07-22 00:14:51vstinnerlinkissue6540 messages
2009-07-22 00:14:50vstinnercreate