[issue36285] Integer overflow in array.array.remove()

[Serhiy Storchaka]

Change by Serhiy Storchaka :


--
resolution:  -> fixed
stage: patch review -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue36285] Integer overflow in array.array.remove()

[Irit Katriel]

Irit Katriel  added the comment:

Can this be closed? It was not backported to 3.7, but that's over now right?

--
nosy: +iritkatriel

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue36285] Integer overflow in array.array.remove()

[Serhiy Storchaka]

Serhiy Storchaka  added the comment:


New changeset aa3ecb80416958eb6fe8cc1b0dfbbfdfbcccead1 by Serhiy Storchaka 
(sth) in branch 'master':
bpo-36285: Fix integer overflow in the array module. (GH-12317)
https://github.com/python/cpython/commit/aa3ecb80416958eb6fe8cc1b0dfbbfdfbcccead1


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue36285] Integer overflow in array.array.remove()

[Karthikeyan Singaravelan]

Change by Karthikeyan Singaravelan :


--
nosy: +serhiy.storchaka, vstinner

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue36285] Integer overflow in array.array.remove()

[Stephan Hohe]

Change by Stephan Hohe :


--
keywords: +patch
pull_requests: +12291
stage:  -> patch review

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue36285] Integer overflow in array.array.remove()

[Stephan Hohe]

New submission from Stephan Hohe :

The array module's `array.remove(x)` iterates over the array, searching for 
`x`. If the array contains >=2G elements this can overflow the `int` loop 
variable.

`array__array_reconstructor_impl()` also contains loops with `int` variables 
that likely have the similar problems.

Changing the loop variables to `Py_ssize_t` fixes the problem. For details see 
the PR.

--
components: Extension Modules
messages: 337889
nosy: sth
priority: normal
severity: normal
status: open
title: Integer overflow in array.array.remove()
type: crash
versions: Python 2.7, Python 3.4, Python 3.5, Python 3.6, Python 3.7, Python 3.8

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com