python · serhiy-storchaka · Oct 7, 2017
diff --git a/Include/listobject.h b/Include/listobject.h
@@ -62,6 +62,7 @@ PyAPI_FUNC(int) PyList_Reverse(PyObject *);
 PyAPI_FUNC(PyObject *) PyList_AsTuple(PyObject *);
 #ifndef Py_LIMITED_API
 PyAPI_FUNC(PyObject *) _PyList_Extend(PyListObject *, PyObject *);
+PyAPI_FUNC(PyObject *) _PyList_Copy(PyObject *);
 
 PyAPI_FUNC(int) PyList_ClearFreeList(void);
 PyAPI_FUNC(void) _PyList_DebugMallocStats(FILE *out);

@@ -105,14 +105,16 @@ future_schedule_callbacks(FutureObj *fut)
         return 0;
     }
 
-    callbacks = PyList_GetSlice(fut->fut_callbacks, 0, len);
+    callbacks = _PyList_Copy(fut->fut_callbacks);
     if (callbacks == NULL) {
         return -1;
     }
+    len = PyList_GET_SIZE(fut->fut_callbacks);
     if (PyList_SetSlice(fut->fut_callbacks, 0, len, NULL) < 0) {
         Py_DECREF(callbacks);
         return -1;
     }
+    len = PyList_GET_SIZE(callbacks);
 
     for (i = 0; i < len; i++) {
         PyObject *handle;

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
@@ -912,9 +912,17 @@ _elementtree_Element___getstate___impl(ElementObject *self)
     PyObject *instancedict = NULL, *children;
 
     /* Build a list of children. */
+  again:
     children = PyList_New(self->extra ? self->extra->length : 0);
     if (!children)
         return NULL;
+    if (PyList_GET_SIZE(children) != (self->extra ? self->extra->length : 0)) {
+        /* Durnit.  The allocations caused the extra to resize.
+         * Just start over, this shouldn't normally happen.
+         */
+        Py_DECREF(children);
+        goto again;
+    }
     for (i = 0; i < PyList_GET_SIZE(children); i++) {
         PyObject *child = self->extra->children[i];
         Py_INCREF(child);
@@ -1375,12 +1383,20 @@ _elementtree_Element_getchildren_impl(ElementObject *self)
         return NULL;
     }
 
+  again:
     if (!self->extra)
         return PyList_New(0);
 
     list = PyList_New(self->extra->length);
     if (!list)
         return NULL;
+    if (PyList_GET_SIZE(list) != (self->extra ? self->extra->length : 0)) {
+        /* Durnit.  The allocations caused the extra to resize.
+         * Just start over, this shouldn't normally happen.
+         */
+        Py_DECREF(list);
+        goto again;
+    }
 
     for (i = 0; i < self->extra->length; i++) {
         PyObject* item = self->extra->children[i];
@@ -1739,6 +1755,7 @@ element_subscr(PyObject* self_, PyObject* item)
         Py_ssize_t start, stop, step, slicelen, cur, i;
         PyObject* list;
 
+  again:
         if (!self->extra)
             return PyList_New(0);
 
@@ -1754,6 +1771,13 @@ element_subscr(PyObject* self_, PyObject* item)
             list = PyList_New(slicelen);
             if (!list)
                 return NULL;
+            if (slicelen != (self->extra ? self->extra->length : 0)) {
+                /* Durnit.  The allocations caused the extra to resize.
+                 * Just start over, this shouldn't normally happen.
+                 */
+                Py_DECREF(list);
+                goto again;
+            }
 
             for (cur = start, i = 0; i < slicelen;
                  cur += step, i++) {
@@ -1788,11 +1812,12 @@ element_ass_subscr(PyObject* self_, PyObject* item, PyObject* value)
         return element_setitem(self_, i, value);
     }
     else if (PySlice_Check(item)) {
-        Py_ssize_t start, stop, step, slicelen, newlen, cur, i;
-
-        PyObject* recycle = NULL;
+        Py_ssize_t start, stop, step, slicelen, oldlen, newlen, cur, i;
+        PyObject* recycle;
         PyObject* seq;
 
+  again:
+        recycle = NULL;
         if (!self->extra) {
             if (create_extra(self, NULL) < 0)
                 return -1;
@@ -1801,6 +1826,7 @@ element_ass_subscr(PyObject* self_, PyObject* item, PyObject* value)
         if (PySlice_Unpack(item, &start, &stop, &step) < 0) {
             return -1;
         }
+        oldlen = self->extra->length;
         slicelen = PySlice_AdjustIndices(self->extra->length, &start, &stop,
                                          step);
 
@@ -1827,9 +1853,15 @@ element_ass_subscr(PyObject* self_, PyObject* item, PyObject* value)
              * scheduled for removal.
             */
             if (!(recycle = PyList_New(slicelen))) {
-                PyErr_NoMemory();
                 return -1;
             }
+            if (oldlen != (self->extra ? self->extra->length : 0)) {
+                /* Durnit.  The allocations caused the extra to resize.
+                 * Just start over, this shouldn't normally happen.
+                 */
+                Py_DECREF(recycle);
+                goto again;
+            }
 
             /* This loop walks over all the children that have to be deleted,
              * with cur pointing at them. num_moved is the amount of children
@@ -1899,6 +1931,14 @@ element_ass_subscr(PyObject* self_, PyObject* item, PyObject* value)
                 Py_DECREF(seq);
                 return -1;
             }
+            oldlen += newlen - slicelen;
+            if (oldlen != (self->extra ? self->extra->length : 0)) {
+                /* Durnit.  The allocations caused the extra to resize.
+                 * Just start over, this shouldn't normally happen.
+                 */
+                Py_DECREF(seq);
+                goto again;
+            }
         }
 
         if (slicelen > 0) {
@@ -1910,6 +1950,14 @@ element_ass_subscr(PyObject* self_, PyObject* item, PyObject* value)
                 Py_DECREF(seq);
                 return -1;
             }
+            if (oldlen != (self->extra ? self->extra->length : 0)) {
+                /* Durnit.  The allocations caused the extra to resize.
+                 * Just start over, this shouldn't normally happen.
+                 */
+                Py_DECREF(seq);
+                Py_DECREF(recycle);
+                goto again;
+            }
             for (cur = start, i = 0; i < slicelen;
                  cur += step, i++)
                 PyList_SET_ITEM(recycle, i, self->extra->children[cur]);

@@ -86,10 +86,19 @@ weakref_getweakrefs(PyObject *self, PyObject *object)
 
     if (PyType_SUPPORTS_WEAKREFS(Py_TYPE(object))) {
         PyWeakReference **list = GET_WEAKREFS_LISTPTR(object);
-        Py_ssize_t count = _PyWeakref_GetWeakrefCount(*list);
+        Py_ssize_t count;
+  again:
+        count = _PyWeakref_GetWeakrefCount(*list);
 
         result = PyList_New(count);
         if (result != NULL) {
+            if (count != _PyWeakref_GetWeakrefCount(*list)) {
+                /* Durnit.  The allocations caused the list to resize.
+                 * Just start over, this shouldn't normally happen.
+                 */
+                Py_DECREF(result);
+                goto again;
+            }
             PyWeakReference *current = *list;
             Py_ssize_t i;
             for (i = 0; i < count; ++i) {

diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c
@@ -1565,15 +1565,32 @@ static PyObject *
 array_array_tolist_impl(arrayobject *self)
 /*[clinic end generated code: output=00b60cc9eab8ef89 input=a8d7784a94f86b53]*/
 {
-    PyObject *list = PyList_New(Py_SIZE(self));
+    PyObject *list;
     Py_ssize_t i;
 
+  again:
+    list = PyList_New(Py_SIZE(self));
     if (list == NULL)
         return NULL;
+    if (PyList_GET_SIZE(list) != Py_SIZE(self)) {
+        /* Durnit.  The allocations caused the array to resize.
+         * Just start over, this shouldn't normally happen.
+         */
+        Py_DECREF(list);
+        goto again;
+    }
     for (i = 0; i < Py_SIZE(self); i++) {
         PyObject *v = getarrayitem((PyObject *)self, i);
         if (v == NULL)
             goto error;
+        if (PyList_GET_SIZE(list) != Py_SIZE(self)) {
+            /* Durnit.  The allocations caused the array to resize.
+             * Just start over, this shouldn't normally happen.
+             */
+            Py_DECREF(v);
+            Py_DECREF(list);
+            goto again;
+        }
         if (PyList_SetItem(list, i, v) < 0)
             goto error;
     }

@@ -507,11 +507,20 @@ static PyObject *
 teedataobject_reduce(teedataobject *tdo)
 {
     int i;
+    PyObject *values;
     /* create a temporary list of already iterated values */
-    PyObject *values = PyList_New(tdo->numread);
+  again:
+    values = PyList_New(tdo->numread);
 
     if (!values)
         return NULL;
+    if (PyList_GET_SIZE(values) != tdo->numread) {
+        /* Durnit.  The allocations caused the number of already iterated values to change.
+         * Just start over, this shouldn't normally happen.
+         */
+        Py_DECREF(values);
+        goto again;
+    }
     for (i=0 ; i<tdo->numread ; i++) {
         Py_INCREF(tdo->values[i]);
         PyList_SET_ITEM(values, i, tdo->values[i]);

diff --git a/Modules/posixmodule.c b/Modules/posixmodule.c
@@ -414,7 +414,7 @@ run_at_forkers(PyObject *lst, int reverse)
         /* Use a list copy in case register_at_fork() is called from
          * one of the callbacks.
          */
-        cpy = PyList_GetSlice(lst, 0, PyList_GET_SIZE(lst));
+        cpy = _PyList_Copy(lst);
         if (cpy == NULL)
             PyErr_WriteUnraisable(lst);
         else {