SF patch 514641 (Naofumi Honda) - Negative ob_size of LongObjects
Due to the bizarre definition of _PyLong_Copy(), creating an instance
of a subclass of long with a negative value could cause core dumps
later on. Unfortunately it looks like the behavior of _PyLong_Copy()
is quite intentional, so the fix is more work than feels comfortable.
This fix is almost, but not quite, the code that Naofumi Honda added;
in addition, I added a test case.
diff --git a/Objects/abstract.c b/Objects/abstract.c
index 2acfd08..cae474c 100644
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -933,8 +933,16 @@
Py_INCREF(o);
return o;
}
- if (PyLong_Check(o))
- return _PyLong_Copy((PyLongObject *)o);
+ if (PyLong_Check(o)) {
+ PyObject *res;
+
+ res = _PyLong_Copy((PyLongObject *)o);
+ if (res != NULL)
+ ((PyLongObject *)res)->ob_size =
+ ((PyLongObject *)o)->ob_size;
+
+ return res;
+ }
if (PyString_Check(o))
/* need to do extra error checking that PyLong_FromString()
* doesn't do. In particular long('9.5') must raise an