DmitryJ added the comment:

Offending code in 2.7:

Let n = 16, where = 0; memmove() then attempts to copy (n - where) = 16 bytes 
where it should have copied 15, since we drop one. This appears to be a typical 
case of off-by-one. Changing (n - where) to (n - where - 1) should fix the 
issue. This underfows when (where + 1) > n, but this case is guarded against in 
bytearray_pop() and cannot occur in bytearray_remove().

The exact same memmove() invocation code is found in all 3.x branches as well.

nosy: +dev_zzo

Python tracker <>
Python-bugs-list mailing list

Reply via email to