commit 4a42cd48d57d67362301ee4ac0344199217fa645
author Benjamin Peterson <benjamin@python.org> Sat Mar 15 12:21:28 2014 -0500
committer Benjamin Peterson <benjamin@python.org> Sat Mar 15 12:21:28 2014 -0500
tree a80d9550d2f614504f9c41f208ce0d1b08cc7861
parent c77e7a4f233453a4e39fc7f61c72e6ef3877dcd1

avoid referencing past the bounds of an array

Objects/listobject.c

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 5f3e282..ae36577 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -1963,7 +1963,7 @@
             if (keys[i] == NULL) {
                 for (i=i-1 ; i>=0 ; i--)
                     Py_DECREF(keys[i]);
-                if (keys != &ms.temparray[saved_ob_size+1])
+                if (saved_ob_size >= MERGESTATE_TEMP_SIZE/2)
                     PyMem_FREE(keys);
                 goto keyfunc_fail;
             }