Closes: #556025 seg fault when doing list(xrange(1e9))

A MemoryError is now raised when the list cannot be created.
There is a test, but as the comment says, it really only
works for 32 bit systems.  I don't know how to improve
the test for other systems (ie, 64 bit or systems
where the data size != addressable size,
e.g. 64 bit data, but 48 bit addressable memory)

diff --git a/Lib/test/test_b1.py b/Lib/test/test_b1.py
index d7e09250df21d8f8db1059a05a296ba1c2268326..e30f3bfcc0ad7f8303e20b6e62cd0769bf688a2f 100644 (file)
--- a/Lib/test/test_b1.py
+++ b/Lib/test/test_b1.py
@@ -499,6 +499,17 @@ if list((0, 1, 2, 3)) != [0, 1, 2, 3]: raise TestFailed, 'list((0, 1, 2, 3))'
 if list('') != []: raise TestFailed, 'list('')'
 if list('spam') != ['s', 'p', 'a', 'm']: raise TestFailed, "list('spam')"
 
+try:
+    # Verify clearing of bug #556025
+    # this assumes that the max data size (sys.maxint) == max address size
+    # this also assumes that the address size is at least 4 bytes
+    # with 8 byte addresses, the bug is not well tested
+    list(xrange(sys.maxint / 4))
+except MemoryError:
+    pass
+else:
+    raise TestFailed, 'list(xrange(sys.maxint / 4))'
+
 print 'long'
 if long(314) != 314L: raise TestFailed, 'long(314)'
 if long(3.14) != 3L: raise TestFailed, 'long(3.14)'

diff --git a/Objects/listobject.c b/Objects/listobject.c
index f3821f86fac03cecf3c25a9516c4509f4ac55861..355b2927c0521c3f3ff9f562d050b11d2c04fe95 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -44,7 +44,14 @@ roundupsize(int n)
        return ((n >> nbits) + 1) << nbits;
  }
 
-#define NRESIZE(var, type, nitems) PyMem_RESIZE(var, type, roundupsize(nitems))
+#define NRESIZE(var, type, nitems)                             \
+do {                                                           \
+       size_t _new_size = roundupsize(nitems);                 \
+       if (_new_size <= ((~(size_t)0) / sizeof(type)))         \
+               PyMem_RESIZE(var, type, _new_size);             \
+       else                                                    \
+               var = NULL;                                     \
+} while (0)
 
 PyObject *
 PyList_New(int size)
@@ -1565,8 +1572,10 @@ list_fill(PyListObject *result, PyObject *v)
        if (n < 0)
                n = 8;  /* arbitrary */
        NRESIZE(result->ob_item, PyObject*, n);
-       if (result->ob_item == NULL)
+       if (result->ob_item == NULL) {
+               PyErr_NoMemory();
                goto error;
+       }
        for (i = 0; i < n; i++)
                result->ob_item[i] = NULL;
        result->ob_size = n;
@@ -1714,7 +1723,7 @@ PyTypeObject PyList_Type = {
        (initproc)list_init,                    /* tp_init */
        PyType_GenericAlloc,                    /* tp_alloc */
        PyType_GenericNew,                      /* tp_new */
-       _PyObject_GC_Del,                       /* tp_free */
+       _PyObject_GC_Del,                       /* tp_free */
 };