[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Antoine Pitrou added the comment: Thank you. This is now pushed. -- resolution: -> fixed stage: commit review -> resolved status: open -> closed ___ Python tracker ___ _

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Roundup Robot added the comment: New changeset 1590c594550e by Antoine Pitrou in branch '3.4': Issue #22335: Fix crash when trying to enlarge a bytearray to 0x7fff bytes on a 32-bit platform. https://hg.python.org/cpython/rev/1590c594550e New changeset f0b334ae95c9 by Antoine Pitrou in bran

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Serhiy Storchaka added the comment: LGTM. -- stage: patch review -> commit review ___ Python tracker ___ ___ Python-bugs-list mailing

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Changes by Antoine Pitrou : -- components: +Interpreter Core stage: needs patch -> patch review ___ Python tracker ___ ___ Python-bugs

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Antoine Pitrou added the comment: Here is a patch. It also fixes a bug in the debug allocators, which didn't properly check for Py_ssize_t overflow. -- Added file: http://bugs.python.org/file37108/ba_resize.patch ___ Python tracker

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Antoine Pitrou added the comment: Note that there are two possible crashes in debug mode: $ ./python -c "bytearray(2**31-1)" Erreur de segmentation $ ./python -c "bytearray(2**31-2)" python: Objects/obmalloc.c:1179: _PyObject_Alloc: Assertion `nelem <= ((Py_ssize_t)(((size_t)-1)>>1)) / elsize'

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Serhiy Storchaka added the comment: "logical_offset + 1" can't overflow because logical_offset is an offset in allocated array not counting final null byte. -- ___ Python tracker __

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Changes by Ezio Melotti : -- nosy: +ezio.melotti ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.p

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Changes by Arfrever Frehtes Taifersar Arahesis : -- nosy: +Arfrever ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscri

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Jakub Wilk added the comment: On a second thought, "logical_offset + 1" alone could overflow; and there are apparently other possible integer overflows in this function. -- ___ Python tracker _

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Jakub Wilk added the comment: This patch should fix it. -- keywords: +patch nosy: +jwilk Added file: http://bugs.python.org/file36917/issue19087.patch ___ Python tracker ___

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Changes by STINNER Victor : -- nosy: +haypo ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

Serhiy Storchaka added the comment: Looks as integer overflow introduced in issue19087. +if (size + logical_offset + 1 < alloc) { -- nosy: +pitrou, serhiy.storchaka stage: -> needs patch versions: +Python 3.5 ___ Python tracker

[issue22335] Python 3: Segfault instead of MemoryError when bytearray too big

New submission from swanson: On Python 3, but not Python 2, you crash with a Segmentation Fault instead of getting a MemoryError as expected. It seems to only be a problem with bytearray, not with other things like tuple: $ python3 Python 3.4.0 (default, Apr 11 2014, 13:05:18) [GCC 4.8.2] on