- #122162 -- unicodeobject.c --- Fix unicode .split() off-by-one

- Loosely based on patch #103249 -- Fix core dumps in PyUnicode_Count

diff --git a/Misc/NEWS b/Misc/NEWS
index 8435758e113a74207df256ff313b11ad2b8548e6..29832975bebf4ba6513e5e2372e1fca663e2644f 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -64,6 +64,10 @@ http://sourceforge.net/tracker/index.php?func=detail&aid=<id>&group_id=5470&atid
   unbound methods to be reclaimed.  This plugs a large memory leak in a
   common Py_Initialize()/dosomething/Py_Finalize() loop.
 
+- #122162 -- unicodeobject.c --- Fix unicode .split() off-by-one
+
+- Loosely based on patch #103249 -- Fix core dumps in PyUnicode_Count
+
 What's New in Python 2.0?
 =========================
 

diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index 6ba907e1e81391cb929cfa9118942a6570433b4b..0c7a9999e548d78212cfa73d62a47e0f8f1ac2ba 100644 (file)
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -1236,9 +1236,14 @@ string_count(PyStringObject *self, PyObject *args)
                sub = PyString_AS_STRING(subobj);
                n = PyString_GET_SIZE(subobj);
        }
-       else if (PyUnicode_Check(subobj))
-               return PyInt_FromLong(
-                       PyUnicode_Count((PyObject *)self, subobj, i, last));
+       else if (PyUnicode_Check(subobj)) {
+               int count;
+               count = PyUnicode_Count((PyObject *)self, subobj, i, last);
+               if (count == -1)
+                       return NULL;
+               else
+                       return PyInt_FromLong((long) count);
+       }
        else if (PyObject_AsCharBuffer(subobj, &sub, &n))
                return NULL;
 
@@ -1637,10 +1642,15 @@ string_startswith(PyStringObject *self, PyObject *args)
                prefix = PyString_AS_STRING(subobj);
                plen = PyString_GET_SIZE(subobj);
        }
-       else if (PyUnicode_Check(subobj))
-               return PyInt_FromLong(
-                       PyUnicode_Tailmatch((PyObject *)self, 
-                                           subobj, start, end, -1));
+       else if (PyUnicode_Check(subobj)) {
+               int rc;
+               rc = PyUnicode_Tailmatch((PyObject *)self, 
+                                         subobj, start, end, -1);
+               if (rc == -1)
+                       return NULL;
+               else
+                       return PyInt_FromLong((long) rc);
+       }
        else if (PyObject_AsCharBuffer(subobj, &prefix, &plen))
                return NULL;
 
@@ -1690,10 +1700,15 @@ string_endswith(PyStringObject *self, PyObject *args)
                suffix = PyString_AS_STRING(subobj);
                slen = PyString_GET_SIZE(subobj);
        }
-       else if (PyUnicode_Check(subobj))
-               return PyInt_FromLong(
-                       PyUnicode_Tailmatch((PyObject *)self, 
-                                           subobj, start, end, +1));
+       else if (PyUnicode_Check(subobj)) {
+               int rc;
+               rc = PyUnicode_Tailmatch((PyObject *)self, 
+                                         subobj, start, end, +1);
+               if (rc == -1)
+                       return NULL;
+               else
+                       return PyInt_FromLong((long) rc);
+       }
        else if (PyObject_AsCharBuffer(subobj, &suffix, &slen))
                return NULL;
 

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index b31675b496889bb11ff1a32493094f1a3b42ba3b..cccdb167e7e8d65cb4e0ccef65bbad9e40e79dd0 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -2357,6 +2357,17 @@ int count(PyUnicodeObject *self,
 {
     int count = 0;
 
+    if (start < 0)
+        start += self->length;
+    if (start < 0)
+        start = 0;
+    if (end > self->length)
+        end = self->length;
+    if (end < 0)
+        end += self->length;
+    if (end < 0)
+        end = 0;
+
     if (substring->length == 0)
        return (end - start + 1);
 
@@ -2925,7 +2936,7 @@ PyObject *split_substring(PyUnicodeObject *self,
     int sublen = substring->length;
     PyObject *str;
 
-    for (i = j = 0; i < len - sublen; ) {
+    for (i = j = 0; i <= len - sublen; ) {
        if (Py_UNICODE_MATCH(self, i, substring)) {
            if (maxcount-- <= 0)
                break;