Roundup Robot added the comment:
New changeset 274c1b0a2494 by Serhiy Storchaka in branch '2.7':
Issue #23985: Fixed integer overflow in iterator object. Original patch by
https://hg.python.org/cpython/rev/274c1b0a2494
New changeset 5b86a1abc8c3 by Serhiy Storchaka in branch '3.4':
Issue
Serhiy Storchaka added the comment:
Sorry, it was related to issue22939.
--
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue23985
___
___
Martin Panter added the comment:
Posting a new patch which combines both fixes and adds some test cases. However
the test needs Python to be built with “./configure --with-pydebug” to detect
the buffer overrun; without this the test will probably silently pass.
I removed the offending buffer
Roundup Robot added the comment:
New changeset 98c1201d8eea by Antoine Pitrou in branch '3.4':
Issue #23985: Fix a possible buffer overrun when deleting a slice from the
front of a bytearray and then appending some other bytes data.
https://hg.python.org/cpython/rev/98c1201d8eea
New changeset
Antoine Pitrou added the comment:
I've committed the patch. Thanks, Martin!
--
resolution: - fixed
stage: patch review - resolved
status: open - closed
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue23985
Changes by Steve Dower steve.do...@microsoft.com:
--
nosy: -steve.dower
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue23985
___
___
Martin Panter added the comment:
Antoine, would you have a chance to review my patches? I assume you were
responsible for adding the ob_start field.
It would be nice to see this bug fixed in the next 3.4 and 3.5 releases. As
well as the original poster’s problem, I suspect this bug may be the
Antoine Pitrou added the comment:
Sorry. I'll take a look!
--
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue23985
___
___
Python-bugs-list mailing
Johan Dahlberg added the comment:
Thank you all for working really fast on this issue!
I'm happy to see that a fix is already being tried out.
--
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue23985
Martin Panter added the comment:
A test case for this that would trigger when memory debugging is enabled could
look something like the following. Would it be appropriate to add it to the
test suite?
a = bytearray(10)
size = sys.getsizeof(a)
a.pop() # Defeat expanding buffer off-by-one quirk
Martin Panter added the comment:
This bug might have been caused by the changes for Issue 19087, so I left a
note there. It looks like that issue added the ob_start field to bytearray()
objects, so that deleting from the start does not require memory copying.
--
New submission from Johan Dahlberg:
Python 3.4.3 crashes after some time when running the attached program under
Windows 7.
The program appends a fixed bytes string to two independent bytearray buffers.
If slices are removed from the beginnging of the two buffers and the two
buffers are
Ned Deily added the comment:
Reproduced with top of trunk default branch on OS X (so, not Windows-specific).
With debug enabled:
$ ./bin/python3.5 /tmp/b/bytearray_bug.py
buf2: 13 5 bytearray(b'1234567890123')
buf1: 13 3 bytearray(b'1234567890123')
buf2: 21 2
Ned Deily added the comment:
Above was in 64-bit mode (x86_64). Same run in 32-bit (i386):
$ ./bin/python3.5-32 /tmp/b/bytearray_bug.py
buf2: 13 2 bytearray(b'1234567890123')
buf1: 13 11 bytearray(b'1234567890123')
buf2: 24 16 bytearray(b'345678901231234567890123')
buf1: 15 4
Wolfgang Maier added the comment:
Also happening with Python 3.4.0 on Ubuntu 14.04 (after ~ half a minute and A
LOT of output):
[skipping lots of lines]
buf2: 29 13 bytearray(b'12312345678901231234567890123')
buf1: 25 9 bytearray(b'2345678901231234567890123')
buf2: 29 2
Changes by Serhiy Storchaka storch...@gmail.com:
--
nosy: +pitrou, serhiy.storchaka
priority: normal - high
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue23985
___
Alexei Romanov added the comment:
No problem with python 2.7.6 on Ubuntu 14.04.2 LTS amd64. Attached script was
working about 2 hours - no crash.
--
nosy: +alexei.romanov
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue23985
Wolfgang Maier added the comment:
Surprisingly, a much simpler version with just one bytearray seems to run
stably (for several minutes at least), but when you wait a while then hit
Ctrl-C, you are getting a Segmentation fault:
Python 3.4.0 (default, Apr 11 2014, 13:05:11)
[GCC 4.8.2] on
Terry J. Reedy added the comment:
Win7, 64 bit, 3.5.0a3: crash in about 10 seconds.
--
nosy: +terry.reedy
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue23985
___
Martin Panter added the comment:
Here is a reduced version without using random numbers that reliably crashes
for me on 64-bit Linux. Hopefully it also crashes for others, and they can
investigate further. Crashes for me with the standard Arch Linux binary:
Python 3.4.3 (default, Feb 26 2015,
Martin Panter added the comment:
After cleaning my build and rebuilding with “./configure --with-pymalloc
--with-pydebug”, I reduced my script to these four lines:
b1 = bytearray(babcdefghij) # 10 bytes
del b1[:1]
del b1[:1]
b1 += bklmnopq # 7 bytes
Patch bytearray-fix.patch fixes the bug
Martin Panter added the comment:
Posting bytearray-resize.patch which stops “del” from expanding the allocated
buffer. This one is not necessary to fix the reported bug, but avoids the
separate quirk identified in step 2.
--
stage: needs patch - patch review
Added file:
22 matches
Mail list logo
