Fix buffer offset calculation (need to compute it before changing
'base'). Fixes SF bug #1033720. Move offset sanity checking to
buffer_from_memory().
diff --git a/Objects/bufferobject.c b/Objects/bufferobject.c
index 6adf838..e0344d8 100644
--- a/Objects/bufferobject.c
+++ b/Objects/bufferobject.c
@@ -66,6 +66,11 @@
"size must be zero or positive");
return NULL;
}
+ if (offset < 0) {
+ PyErr_SetString(PyExc_ValueError,
+ "offset must be zero or positive");
+ return NULL;
+ }
b = PyObject_NEW(PyBufferObject, &PyBuffer_Type);
if ( b == NULL )
@@ -85,20 +90,11 @@
static PyObject *
buffer_from_object(PyObject *base, int size, int offset, int readonly)
{
- if ( offset < 0 ) {
- PyErr_SetString(PyExc_ValueError,
- "offset must be zero or positive");
- return NULL;
- }
-
- /* if the base object is another buffer, then try to refer to the
- * base object.
- */
if ( PyBuffer_Check(base) && (((PyBufferObject *)base)->b_base) ) {
+ /* another buffer, refer to the base object */
+ offset += ((PyBufferObject *)base)->b_offset;
base = ((PyBufferObject *)base)->b_base;
- offset = ((PyBufferObject *)base)->b_offset + offset;
}
-
return buffer_from_memory(base, size, offset, NULL, readonly);
}