[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

Change by Cheryl Sabella : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

miss-islington added the comment: New changeset 367fe5757a707c4e3602dee807a9315199ed0b5c by Miss Islington (bot) in branch '3.7': bpo-35091: Objects/listobject.c: Replace overflow checks in gallop fu… (GH-10202)

[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

miss-islington added the comment: New changeset 6bc5917903b722bdd0e5d3020949f26fec5dfe9a by Miss Islington (bot) (Alexey Izbyshev) in branch 'master': bpo-35091: Objects/listobject.c: Replace overflow checks in gallop fu… (GH-10202)

[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

Change by miss-islington : -- pull_requests: +13431 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

Tim Peters added the comment: I left the code in because it was harmless (a 100%-predictable branch), and it was easier to show that overflow was _considered_ than to explain in full why it was impossible. In the context of CPython. For example, the Java port of this code couldn't rely on

[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

Alexey Izbyshev added the comment: > This doesn't actually matter - the code can never trigger. Yes, I considered this, and wondered why assert wasn't used in the first place, but the explicit check with a comment suggested that possibility of overflow was deemed real. I've submitted a

[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

Change by Alexey Izbyshev : -- pull_requests: +9520 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

Tim Peters added the comment: This doesn't actually matter - the code can never trigger. It would be fine to replace it with an assert to that effect (see below for a specific suggestion). The reason: The indices in this code are into vectors of PyObject*. These vectors can't contain

[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

Change by Raymond Hettinger : -- assignee: -> tim.peters nosy: +tim.peters ___ Python tracker ___ ___ Python-bugs-list mailing

[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

Change by Alexey Izbyshev : -- pull_requests: +9507 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

Change by Alexey Izbyshev : -- keywords: +patch pull_requests: +9498 stage: -> patch review ___ Python tracker ___ ___

[issue35091] Objects/listobject.c: gallop functions rely on signed integer overflow

New submission from Alexey Izbyshev : gallop_left() and gallop_right() functions explicitly rely on overflowing behavior of Py_ssize_t (https://github.com/python/cpython/blob/6015cc50bc38b9e920ce4986ee10658eaa14f561/Objects/listobject.c#L1361): ofs = (ofs << 1) + 1; if (ofs <= 0)