New submission from STINNER Victor <victor.stin...@haypocalc.com>: bytearray.translate() crash if: * first argument was converted to a buffer but the buffer length is not 256 bytes * first argument is valid, but the second argument can not be converted to a buffer
The crash occurs because PyBuffer_Release(&vdel) is called whereas vdel buffer is not initialized. Example with Python3: lisa$ ./python Python 3.2a0 (py3k:74029M, Jul 17 2009, 02:29:48) [GCC 4.3.2] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> x=bytearray(b'xyz') >>> x.translate(b'x', 1) Traceback (most recent call last): File "<stdin>", line 1, in <module> ValueError: translation table must be 256 characters long >>> x.translate(b'x', 1) Erreur de segmentation Attached patch fixes the two cases and add an unit test for the first case. As you can see in the example, it's an Heisenbug :-) (compile in debug bug to get reproductible crash) ---------- components: Interpreter Core files: bytearray.patch keywords: patch messages: 90786 nosy: haypo severity: normal status: open title: bytearray.translate(): error in error handling versions: Python 2.6, Python 2.7, Python 3.0, Python 3.1, Python 3.2 Added file: http://bugs.python.org/file14532/bytearray.patch _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue6540> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
