commit bb667d433c9cf535dd2e574d039f4d905f53ff06
author Antoine Pitrou <solipsis@pitrou.net> Sun Jan 17 12:31:10 2010 +0000
committer Antoine Pitrou <solipsis@pitrou.net> Sun Jan 17 12:31:10 2010 +0000
tree e9d5baf036e65d70473e6ddd21aad9691e699f0e
parent 437053eee37cce76563941c5ff546a4f96620367

Merged revisions 77573 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/trunk

........
  r77573 | antoine.pitrou | 2010-01-17 13:26:20 +0100 (dim., 17 janv. 2010) | 6 lines

  Issue #7561: Operations on empty bytearrays (such as `int(bytearray())`)
  could crash in many places because of the PyByteArray_AS_STRING() macro
  returning NULL.  The macro now returns a statically allocated empty
  string instead.
........

Objects/bytearrayobject.c

diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c
index 8aa2928..c4a25c0 100644
--- a/Objects/bytearrayobject.c
+++ b/Objects/bytearrayobject.c
@@ -6,6 +6,7 @@
 #include "bytes_methods.h"
 
 static PyByteArrayObject *nullbytes = NULL;
+char _PyByteArray_empty_string[] = "";
 
 void
 PyByteArray_Fini(void)
@@ -74,7 +75,7 @@
                 "accessing non-existent bytes segment");
         return -1;
     }
-    *ptr = (void *)self->ob_bytes;
+    *ptr = (void *)PyByteArray_AS_STRING(self);
     return Py_SIZE(self);
 }
 
@@ -86,7 +87,7 @@
                 "accessing non-existent bytes segment");
         return -1;
     }
-    *ptr = (void *)self->ob_bytes;
+    *ptr = (void *)PyByteArray_AS_STRING(self);
     return Py_SIZE(self);
 }
 
@@ -106,7 +107,7 @@
                 "accessing non-existent bytes segment");
         return -1;
     }
-    *ptr = self->ob_bytes;
+    *ptr = PyByteArray_AS_STRING(self);
     return Py_SIZE(self);
 }
 
@@ -119,10 +120,7 @@
                 obj->ob_exports++;
                 return 0;
         }
-        if (obj->ob_bytes == NULL)
-                ptr = "";
-        else
-                ptr = obj->ob_bytes;
+        ptr = (void *) PyByteArray_AS_STRING(obj);
         ret = PyBuffer_FillInfo(view, (PyObject*)obj, ptr, Py_SIZE(obj), 0, flags);
         if (ret >= 0) {
                 obj->ob_exports++;
@@ -201,7 +199,7 @@
             Py_DECREF(new);
             return PyErr_NoMemory();
         }
-        if (bytes != NULL)
+        if (bytes != NULL && size > 0)
             memcpy(new->ob_bytes, bytes, size);
         new->ob_bytes[size] = '\0';  /* Trailing null byte */
     }