1 # 2 # The various methods of bufferobject.c (here buffer_subscript()) call 3 # get_buf() before calling potentially more Python code (here via 4 # PySlice_GetIndicesEx()). But get_buf() already returned a void* 5 # pointer. This void* pointer can become invalid if the object 6 # underlying the buffer is mutated (here a bytearray object). 7 # 8 # As usual, please keep in mind that the three "here" in the sentence 9 # above are only examples. Each can be changed easily and lead to 10 # another crasher. 11 # 12 # This crashes for me on Linux 32-bits with CPython 2.6 and 2.7 13 # with a segmentation fault. 14 # 15 16 17 class PseudoIndex(object): 18 def __index__(self): 19 for c in "foobar"*n: 20 a.append(c) 21 return n * 4 22 23 24 for n in range(1, 100000, 100): 25 a = bytearray("test"*n) 26 buf = buffer(a) 27 28 s = buf[:PseudoIndex():1] 29 #print repr(s) 30 #assert s == "test"*n 31
