Repository navigation
[3.15] gh-160303: Fix bytearray state after a failed del b[:n] (GH-160304) - #161836
Merged
Merged
Conversation
…GH-160304) * pythongh-160303: Fix bytearray state after a failed del b[:n] When shrinking the storage of a bytearray which has a logical offset, allocate the new buffer before modifying the object, so that bytearray_setslice_linear() can restore ob_start if the allocation fails. * pythongh-160303: Keep ob_start instead of allocating in del b[:n] Move ob_start and the size before the shrinking resize, so a failed shrink leaves the bytes removed and the larger block in place, as the non-front path already does. Split the checks out of bytearray_resize_lock_held() so the slice code can resize directly. Move the tests into test_resize_error. * pythongh-160303: Test failed shrinks not at the front; narrow the unchecked resize Only the front path of bytearray_setslice_linear() calls bytearray_resize_unchecked(): it has already advanced ob_start and reduced the size, so bytearray_resize_lock_held() would return early without releasing memory. Other slices go through bytearray_resize_lock_held() again and keep the failure fixup to themselves. test_resize_error now also covers slices in the middle and at the end, and checks the null byte after the data with float(). (cherry picked from commit 35e2c5abc940e616d84542d32bef80c4ae1faf2c) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
After a failed
del b[:n],bytearray_setslice_linear()movedob_startback, butbytearray_resize_storage()had already realigned the data and resetob_start, so the bytearray then startednbytes before its buffer. The front-delete path now movesob_startand the size before the shrinking resize and no longer restores anything, so a failed shrink leaves the bytes removed and the larger block in place, raisingMemoryErroras the non-front path already does. The checks inbytearray_resize_lock_held()are split from a newbytearray_resize_unchecked()so the slice code can call it directly without changing other callers, and the non-front failure path now writes the trailing null byte it was missing.Fixes #160303
ANT-2026-QRZ6IDTC
bytearrayreads and writes outside its buffer afterdel b[:n]fails withMemoryError#160303(cherry picked from commit 35e2c5a)
Co-authored-by: Gregory P. Smith 68491+gpshead@users.noreply.github.com