Issue #23985: Fixed integer overflow in iterator object. Patch by
Clement Rouault.
diff --git a/Lib/test/test_iter.py b/Lib/test/test_iter.py
index e06f239..abc408f 100644
--- a/Lib/test/test_iter.py
+++ b/Lib/test/test_iter.py
@@ -1,5 +1,6 @@
# Test iterators.
+import sys
import unittest
from test.support import run_unittest, TESTFN, unlink, cpython_only
import pickle
@@ -48,6 +49,10 @@
else:
raise IndexError
+class UnlimitedSequenceClass:
+ def __getitem__(self, i):
+ return i
+
# Main test suite
class TestCase(unittest.TestCase):
@@ -919,6 +924,26 @@
lst.extend(gen())
self.assertEqual(len(lst), 760)
+ @cpython_only
+ def test_iter_overflow(self):
+ # Test for the issue 22939
+ it = iter(UnlimitedSequenceClass())
+ # Manually set `it_index` to PY_SSIZE_T_MAX-2 without a loop
+ it.__setstate__(sys.maxsize - 2)
+ self.assertEqual(next(it), sys.maxsize - 2)
+ self.assertEqual(next(it), sys.maxsize - 1)
+ with self.assertRaises(OverflowError):
+ next(it)
+ # Check that Overflow error is always raised
+ with self.assertRaises(OverflowError):
+ next(it)
+
+ def test_iter_neg_setstate(self):
+ it = iter(UnlimitedSequenceClass())
+ it.__setstate__(-42)
+ self.assertEqual(next(it), 0)
+ self.assertEqual(next(it), 1)
+
def test_main():
run_unittest(TestCase)
diff --git a/Misc/ACKS b/Misc/ACKS
index 7de6de6..b377050 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -1168,6 +1168,7 @@
Just van Rossum
Hugo van Rossum
Saskia van Rossum
+Clement Rouault
Donald Wallace Rouse II
Liam Routt
Todd Rovito
diff --git a/Misc/NEWS b/Misc/NEWS
index 94ea12b..edd6aaa 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@
Core and Builtins
-----------------
+- Issue #23985: Fixed integer overflow in iterator object. Patch by
+ Clement Rouault.
+
- Issue #23985: Fix a possible buffer overrun when deleting a slice from
the front of a bytearray and then appending some other bytes data.
diff --git a/Objects/iterobject.c b/Objects/iterobject.c
index 77ff810..3047d6b 100644
--- a/Objects/iterobject.c
+++ b/Objects/iterobject.c
@@ -54,6 +54,11 @@
seq = it->it_seq;
if (seq == NULL)
return NULL;
+ if (it->it_index == PY_SSIZE_T_MAX) {
+ PyErr_SetString(PyExc_OverflowError,
+ "iter index too large");
+ return NULL;
+ }
result = PySequence_GetItem(seq, it->it_index);
if (result != NULL) {