From: Mark Dickinson <mdickinson@enthought.com>
Date: Sat, 24 Sep 2011 07:56:09 +0000 (+0100)
Subject: Issue #12973: Fix itertools bug caused by signed integer overflow.  Thanks Stefan... 
X-Git-Tag: v3.2.3rc1~550
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b2f6bc72a269a0c4ed389ad232b47e2a42b8dde0;p=thirdparty%2FPython%2Fcpython.git

Issue #12973: Fix itertools bug caused by signed integer overflow.  Thanks Stefan Krah.
---

diff --git a/Misc/NEWS b/Misc/NEWS
index fd98d021e501..1b0373663ea8 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -17,9 +17,9 @@ Core and Builtins
 - Issue #13021: Missing decref on an error path.  Thanks to Suman Saha for
   finding the bug and providing a patch.
 
-- Issue #12973: Fix overflow check that relied on undefined behaviour in
-  list_repeat.  This bug caused test_list to fail with recent versions
-  of Clang.
+- Issue #12973: Fix overflow checks that relied on undefined behaviour in
+  list_repeat (listobject.c) and islice_next (itertoolsmodule.c).  These bugs
+  caused test failures with recent versions of Clang.
 
 - Issue #12802: the Windows error ERROR_DIRECTORY (numbered 267) is now
   mapped to POSIX errno ENOTDIR (previously EINVAL).
diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
index 71d5bb646c9e..8b6fa855a873 100644
--- a/Modules/itertoolsmodule.c
+++ b/Modules/itertoolsmodule.c
@@ -1234,7 +1234,9 @@ islice_next(isliceobject *lz)
         return NULL;
     lz->cnt++;
     oldnext = lz->next;
-    lz->next += lz->step;
+    /* The (size_t) cast below avoids the danger of undefined
+       behaviour from signed integer overflow. */
+    lz->next += (size_t)lz->step;
     if (lz->next < oldnext || (stop != -1 && lz->next > stop))
         lz->next = stop;
     return item;