avoid referencing past the bounds of an array

benjaminp · benjaminp · commit 4a42cd48d57d · 2014-03-15T12:21:28.000-05:00
diff --git a/Objects/listobject.c b/Objects/listobject.c
@@ -1963,7 +1963,7 @@ listsort(PyListObject *self, PyObject *args, PyObject *kwds)
             if (keys[i] == NULL) {
                 for (i=i-1 ; i>=0 ; i--)
                     Py_DECREF(keys[i]);
-                if (keys != &ms.temparray[saved_ob_size+1])
+                if (saved_ob_size >= MERGESTATE_TEMP_SIZE/2)
                     PyMem_FREE(keys);
                 goto keyfunc_fail;
             }

Original file line number	Diff line number	Diff line change
`@@ -1963,7 +1963,7 @@ listsort(PyListObject self, PyObject args, PyObject *kwds)`
`1963`	`1963`	`if (keys[i] == NULL) {`
`1964`	`1964`	`for (i=i-1 ; i>=0 ; i--)`
`1965`	`1965`	`Py_DECREF(keys[i]);`
`1966`		`- if (keys != &ms.temparray[saved_ob_size+1])`
	`1966`	`+ if (saved_ob_size >= MERGESTATE_TEMP_SIZE/2)`
`1967`	`1967`	`PyMem_FREE(keys);`
`1968`	`1968`	`goto keyfunc_fail;`
`1969`	`1969`	`}`