Serhiy Storchaka added the comment:

But I can reproduce the crash with other example.

import random
random.setstate((3, (1,)*624+(-10**9,), None))
random.random()

The index attribute can be set to negative value and this causes reading out of 
the buffer.

Here is a patch that fixes this.

----------
keywords: +patch
stage: needs patch -> patch review
versions: +Python 2.7, Python 3.4, Python 3.5, Python 3.6
Added file: http://bugs.python.org/file39917/random_setstate_index.patch

_______________________________________
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue24620>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

Reply via email to