From: Mark Dickinson <dickinsm@gmail.com>
Date: Mon, 29 Aug 2016 15:40:29 +0000 (+0100)
Subject: Issue #27214: Fix potential bug and remove useless optimization in long_invert. Thank... 
X-Git-Tag: v3.6.0b1~531
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=583c6e860c1f9eee81ebf09fd87e0f921e8c0dd2;p=thirdparty%2FPython%2Fcpython.git

Issue #27214: Fix potential bug and remove useless optimization in long_invert. Thanks Oren Milman.
---

diff --git a/Misc/NEWS b/Misc/NEWS
index 36cf58990166..32144d1311fd 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,10 @@ What's New in Python 3.6.0 beta 1
 Core and Builtins
 -----------------
 
+- Issue #27214: In long_invert, be more careful about modifying object
+  returned by long_add, and remove an unnecessary check for small longs.
+  Thanks Oren Milman for analysis and patch.
+
 - Issue #27506: Support passing the bytes/bytearray.translate() "delete"
   argument by keyword.
 
diff --git a/Objects/longobject.c b/Objects/longobject.c
index 38e707220a2c..89b686260576 100644
--- a/Objects/longobject.c
+++ b/Objects/longobject.c
@@ -4170,8 +4170,10 @@ long_invert(PyLongObject *v)
     Py_DECREF(w);
     if (x == NULL)
         return NULL;
-    Py_SIZE(x) = -(Py_SIZE(x));
-    return (PyObject *)maybe_small_long(x);
+    _PyLong_Negate(&x);
+    /* No need for maybe_small_long here, since any small
+       longs will have been caught in the Py_SIZE <= 1 fast path. */
+    return (PyObject *)x;
 }
 
 static PyObject *