Marcin Bachry <[email protected]> added the comment:
I think the expression "cur + step" in line 2660 of listobject.c (py2.7 trunk)
overflows to negative value and the "if" branch isn't entered.
if (cur + step >= Py_SIZE(self)) {
lim = Py_SIZE(self) - cur - 1;
}
If I change the type of "cur" variable to unsigned int, the bug disappears. I
don't know if it's ok to have unsigned "cur" here though - but I feel it is.
----------
keywords: +patch
nosy: +marcin.bachry
Added file: http://bugs.python.org/file16015/maybe-a-fix.diff
_______________________________________
Python tracker <[email protected]>
<http://bugs.python.org/issue7788>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
