Skip to content

Commit a99bfaa

Browse files
authored
gh-133073: avoid NULL + 0 arithmetic in list_extend_* functions (#133074)
1 parent 4ebbfcf commit a99bfaa

File tree

1 file changed

+22
-6
lines changed

1 file changed

+22
-6
lines changed

Objects/listobject.c

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1315,9 +1315,15 @@ list_extend_set(PyListObject *self, PySetObject *other)
13151315
{
13161316
Py_ssize_t m = Py_SIZE(self);
13171317
Py_ssize_t n = PySet_GET_SIZE(other);
1318-
if (list_resize(self, m + n) < 0) {
1318+
Py_ssize_t r = m + n;
1319+
if (r == 0) {
1320+
return 0;
1321+
}
1322+
if (list_resize(self, r) < 0) {
13191323
return -1;
13201324
}
1325+
1326+
assert(self->ob_item != NULL);
13211327
/* populate the end of self with iterable's items */
13221328
Py_ssize_t setpos = 0;
13231329
Py_hash_t hash;
@@ -1327,7 +1333,7 @@ list_extend_set(PyListObject *self, PySetObject *other)
13271333
FT_ATOMIC_STORE_PTR_RELEASE(*dest, key);
13281334
dest++;
13291335
}
1330-
Py_SET_SIZE(self, m + n);
1336+
Py_SET_SIZE(self, r);
13311337
return 0;
13321338
}
13331339

@@ -1337,10 +1343,15 @@ list_extend_dict(PyListObject *self, PyDictObject *dict, int which_item)
13371343
// which_item: 0 for keys and 1 for values
13381344
Py_ssize_t m = Py_SIZE(self);
13391345
Py_ssize_t n = PyDict_GET_SIZE(dict);
1340-
if (list_resize(self, m + n) < 0) {
1346+
Py_ssize_t r = m + n;
1347+
if (r == 0) {
1348+
return 0;
1349+
}
1350+
if (list_resize(self, r) < 0) {
13411351
return -1;
13421352
}
13431353

1354+
assert(self->ob_item != NULL);
13441355
PyObject **dest = self->ob_item + m;
13451356
Py_ssize_t pos = 0;
13461357
PyObject *keyvalue[2];
@@ -1351,7 +1362,7 @@ list_extend_dict(PyListObject *self, PyDictObject *dict, int which_item)
13511362
dest++;
13521363
}
13531364

1354-
Py_SET_SIZE(self, m + n);
1365+
Py_SET_SIZE(self, r);
13551366
return 0;
13561367
}
13571368

@@ -1360,10 +1371,15 @@ list_extend_dictitems(PyListObject *self, PyDictObject *dict)
13601371
{
13611372
Py_ssize_t m = Py_SIZE(self);
13621373
Py_ssize_t n = PyDict_GET_SIZE(dict);
1363-
if (list_resize(self, m + n) < 0) {
1374+
Py_ssize_t r = m + n;
1375+
if (r == 0) {
1376+
return 0;
1377+
}
1378+
if (list_resize(self, r) < 0) {
13641379
return -1;
13651380
}
13661381

1382+
assert(self->ob_item != NULL);
13671383
PyObject **dest = self->ob_item + m;
13681384
Py_ssize_t pos = 0;
13691385
Py_ssize_t i = 0;
@@ -1379,7 +1395,7 @@ list_extend_dictitems(PyListObject *self, PyDictObject *dict)
13791395
i++;
13801396
}
13811397

1382-
Py_SET_SIZE(self, m + n);
1398+
Py_SET_SIZE(self, r);
13831399
return 0;
13841400
}
13851401

0 commit comments

Comments
 (0)