[Zope-Checkins] CVS: Zope/lib/python/BTrees - BTreeItemsTemplate.c:1.17.10.2

[Tim Peters]

Update of /cvs-repository/Zope/lib/python/BTrees
In directory cvs.zope.org:/tmp/cvs-serv31899/lib/python/BTrees

Modified Files:
      Tag: Zope-2_6-branch
	BTreeItemsTemplate.c 
Log Message:
Backport.
BTreeItems_seek():  If a BTree mutates via deletion while it's being
iterated over, the iterator object can end up pointing into trash memory,
leading to a segfault.  Catch this case and raise an exception instead.


=== Zope/lib/python/BTrees/BTreeItemsTemplate.c 1.17.10.1 => 1.17.10.2 ===
--- Zope/lib/python/BTrees/BTreeItemsTemplate.c:1.17.10.1	Fri Apr 18 14:03:18 2003
+++ Zope/lib/python/BTrees/BTreeItemsTemplate.c	Wed Jun 18 17:19:01 2003
@@ -137,6 +137,7 @@
 {
     int delta, pseudoindex, currentoffset;
     Bucket *b, *currentbucket;
+    int error;
 
     pseudoindex = self->pseudoindex;
     currentoffset = self->currentoffset;
@@ -210,6 +211,21 @@
     }
 
     assert(pseudoindex == i);
+
+    /* Alas, the user may have mutated the bucket since the last time we
+     * were called, and if they deleted stuff, we may be pointing into
+     * trash memory now.
+     */
+    PER_USE_OR_RETURN(currentbucket, -1);
+    error = currentoffset < 0 || currentoffset >= currentbucket->len;
+    PER_ALLOW_DEACTIVATION(currentbucket);
+    PER_ACCESSED(currentbucket);
+    if (error) {
+	PyErr_SetString(PyExc_RuntimeError,
+	                "the bucket being iterated changed size");
+	return -1;
+    }
+
     Py_INCREF(currentbucket);
     Py_DECREF(self->currentbucket);
     self->currentbucket = currentbucket;