avoid referencing out-of-bounds memory

benjaminp · benjaminp · commit ef87f8cb57e1 · 2014-03-14T21:54:31.000-05:00
diff --git a/Objects/listobject.c b/Objects/listobject.c
@@ -2036,7 +2036,7 @@ listsort(PyListObject *self, PyObject *args, PyObject *kwds)
     if (keys != NULL) {
         for (i = 0; i < saved_ob_size; i++)
             Py_DECREF(keys[i]);
-        if (keys != &ms.temparray[saved_ob_size+1])
+        if (saved_ob_size >= MERGESTATE_TEMP_SIZE/2)
             PyMem_FREE(keys);
     }
 

Original file line number	Diff line number	Diff line change
`@@ -2036,7 +2036,7 @@ listsort(PyListObject self, PyObject args, PyObject *kwds)`
`2036`	`2036`	`if (keys != NULL) {`
`2037`	`2037`	`for (i = 0; i < saved_ob_size; i++)`
`2038`	`2038`	`Py_DECREF(keys[i]);`
`2039`		`- if (keys != &ms.temparray[saved_ob_size+1])`
	`2039`	`+ if (saved_ob_size >= MERGESTATE_TEMP_SIZE/2)`
`2040`	`2040`	`PyMem_FREE(keys);`
`2041`	`2041`	`}`
`2042`	`2042`