[Zope-Checkins] CVS: Zope3/lib/python/Persistence/BTrees - BucketTemplate.c:1.7

[Tim Peters]

Update of /cvs-repository/Zope3/lib/python/Persistence/BTrees
In directory cvs.zope.org:/tmp/cvs-serv17685

Modified Files:
	BucketTemplate.c 
Log Message:
Bucket_rangeSearch():  If the min key passed in was larger than the max key
passed in, it was quite possible for this to return *low > *high, and the
caller could crash due to trying to create a list with "negative length".
Changed the routine to consider a range empty if min>max on input, and added
test cases that fail before this patch.


=== Zope3/lib/python/Persistence/BTrees/BucketTemplate.c 1.6 => 1.7 ===
         }
     }
-  else *high=self->len - 1;
+  else *high = self->len - 1;
 
-  return 0;
+  /* If f < l to begin with, it's quite possible that low > high now. */
+  if (*low <= *high)
+    return 0;
 
  empty:
-  *low=0;
-  *high=-1;
+  *low = 0;
+  *high = -1;
   return 0;
 }
 
@@ -1192,7 +1194,7 @@
 /* XXX Even though the _next attribute is read-only, a program could
    probably do arbitrary damage to a the btree internals.  For
    example, it could call clear() on a bucket inside a BTree.
-   
+
    We need to decide if the convenience for inspecting BTrees is worth
    the risk.
 */
@@ -1232,7 +1234,7 @@
      "get(key[,default]) -- Look up a value\n\n"
      "Return the default (or None) if the key is not found."},
 #ifdef PERSISTENT
-    {"_p_resolveConflict", (PyCFunction) bucket__p_resolveConflict, 
+    {"_p_resolveConflict", (PyCFunction) bucket__p_resolveConflict,
      METH_VARARGS,
      "_p_resolveConflict() -- Reinitialize from a newly created copy"},
     {"_p_deactivate", (PyCFunction) bucket__p_deactivate, METH_NOARGS,
@@ -1366,13 +1368,13 @@
     if (!r) {
 	return NULL;
     }
-    rv = PyOS_snprintf(repr, sizeof(repr), 
+    rv = PyOS_snprintf(repr, sizeof(repr),
 		       "%s(%s)", self->ob_type->tp_name,
 		       PyString_AS_STRING(r));
     if (rv > 0 && rv < sizeof(repr)) {
 	Py_DECREF(r);
 	return PyString_FromStringAndSize(repr, strlen(repr));
-    } 
+    }
     else {
 	/* The static buffer wasn't big enough */
 	int size;