Fix an out-of-bound index in pmerge() discovered by Zooko (SF bug
645404). I'm not 100% sure this is the right fix, so I'll keep the
bug report open for Samuele, but this fixes the index error and passes
the test suite (and I can't see why it *shouldn't* be the right fix
:-).
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 45a229a..f05cf7c 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -1067,7 +1067,8 @@
}
for (j = 0; j < to_merge_size; j++) {
PyObject *j_lst = PyList_GET_ITEM(to_merge, j);
- if (PyList_GET_ITEM(j_lst, remain[j]) == candidate) {
+ if (remain[j] < PyList_GET_SIZE(j_lst) &&
+ PyList_GET_ITEM(j_lst, remain[j]) == candidate) {
remain[j]++;
}
}