diff options
| author | Damien George <damien.p.george@gmail.com> | 2019-08-15 23:02:04 +1000 |
|---|---|---|
| committer | Damien George <damien.p.george@gmail.com> | 2019-08-15 23:02:04 +1000 |
| commit | acfbb9febd024475bdcb4ebbe2ec8c0e9a652275 (patch) | |
| tree | 7ed201887084134ccb40db11f9968b3755f5661e /py | |
| parent | baeebc557c3132fa17f3c902e260d5049f7c7957 (diff) | |
py/objarray: Fix amount of free space in array when doing slice assign.
Prior to this patch the amount of free space in an array (including
bytearray) was not being maintained correctly for the case of slice
assignment which changed the size of the array. Under certain cases (as
encoded in the new test) it was possible that the array could grow beyond
its allocated memory block and corrupt the heap.
Fixes issue #4127.
Diffstat (limited to 'py')
| -rw-r--r-- | py/objarray.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/py/objarray.c b/py/objarray.c index 4e58d8e5d..c19617d4e 100644 --- a/py/objarray.c +++ b/py/objarray.c @@ -445,7 +445,7 @@ STATIC mp_obj_t array_subscr(mp_obj_t self_in, mp_obj_t index_in, mp_obj_t value if (len_adj > o->free) { // TODO: alloc policy; at the moment we go conservative o->items = m_renew(byte, o->items, (o->len + o->free) * item_sz, (o->len + len_adj) * item_sz); - o->free = 0; + o->free = len_adj; dest_items = o->items; } mp_seq_replace_slice_grow_inplace(dest_items, o->len, @@ -458,6 +458,7 @@ STATIC mp_obj_t array_subscr(mp_obj_t self_in, mp_obj_t index_in, mp_obj_t value mp_seq_clear(dest_items, o->len + len_adj, o->len, item_sz); // TODO: alloc policy after shrinking } + o->free -= len_adj; o->len += len_adj; return mp_const_none; #else |