[issue24467] bytearray pop and remove Buffer Over-read

2015-07-05 Thread Arfrever Frehtes Taifersar Arahesis
Changes by Arfrever Frehtes Taifersar Arahesis : -- nosy: +Arfrever ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscri

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-29 Thread Serhiy Storchaka
Changes by Serhiy Storchaka : -- components: +Interpreter Core resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___ ___

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-29 Thread Roundup Robot
Roundup Robot added the comment: New changeset a887ce8611d2 by Serhiy Storchaka in branch '2.7': Issue #24467: Fixed possible buffer over-read in bytearray. The bytearray https://hg.python.org/cpython/rev/a887ce8611d2 New changeset c95d7ffa492e by Serhiy Storchaka in branch '3.4': Issue #24467:

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-28 Thread DmitryJ
DmitryJ added the comment: If this is the case, then issue24462 should be fixed by this patch as well. I'm sorry about missing the root cause here. -- ___ Python tracker ___ ___

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-28 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: The bytearray object allocates one byte more for trailing null byte. ob_size always should be less than ob_alloc if ob_alloc != 0. But in rare cases when the bytearray is initialized with an iterator, this rule can be violated. Following patch restores this

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-28 Thread Serhiy Storchaka
Changes by Serhiy Storchaka : -- assignee: -> serhiy.storchaka stage: -> patch review versions: +Python 3.4, Python 3.5, Python 3.6 ___ Python tracker ___ _

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-23 Thread DmitryJ
Changes by DmitryJ : Added file: http://bugs.python.org/file39784/issue24467-3.5.patch ___ Python tracker ___ ___ Python-bugs-list mailing lis

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-23 Thread DmitryJ
Changes by DmitryJ : Added file: http://bugs.python.org/file39783/issue24467-3.4.patch ___ Python tracker ___ ___ Python-bugs-list mailing lis

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-23 Thread DmitryJ
Changes by DmitryJ : Added file: http://bugs.python.org/file39781/issue24467-3.2.patch ___ Python tracker ___ ___ Python-bugs-list mailing lis

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-23 Thread DmitryJ
DmitryJ added the comment: Attached is a patch that fixes the reported issue. Since there are no visible side effects in Python, I could not write a test for this. -- keywords: +patch Added file: http://bugs.python.org/file39780/issue24467-2.7.patch ___

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-23 Thread DmitryJ
Changes by DmitryJ : Added file: http://bugs.python.org/file39782/issue24467-3.3.patch ___ Python tracker ___ ___ Python-bugs-list mailing lis

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-23 Thread Serhiy Storchaka
Changes by Serhiy Storchaka : -- nosy: +serhiy.storchaka ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https:

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-23 Thread DmitryJ
DmitryJ added the comment: Offending code in 2.7: https://hg.python.org/cpython/file/20c9290a5de4/Objects/bytearrayobject.c#l2381 https://hg.python.org/cpython/file/20c9290a5de4/Objects/bytearrayobject.c#l2412 Let n = 16, where = 0; memmove() then attempts to copy (n - where) = 16 bytes where

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-19 Thread Ned Deily
Changes by Ned Deily : -- nosy: +benjamin.peterson ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail

[issue24467] bytearray pop and remove Buffer Over-read

2015-06-18 Thread JohnLeitch
New submission from JohnLeitch: The bytearray pop and remove methods suffer from buffer over-reads caused by memmove use under the assumption that PyByteArrayObject ob_size is less than ob_alloc, leading to a single byte over-read. This condition can be triggered by creating a bytearray from a