SF patch #1005778, Fix seg fault if list object is modified during list.index()

Backport candidate

Lib/test/list_tests.py

@@ -311,6 +311,18 @@ class CommonTest(seq_tests.CommonTest):
         self.assertRaises(ValueError, a.index, 2, 0, 4)
         self.assertEqual(a, self.type2test([-2, -1, 0, 1, 2]))
 
+        # Test modifying the list during index's iteration
+        class EvilCmp:
+            def __init__(self, victim):
+                self.victim = victim
+            def __eq__(self, other):
+                del self.victim[:]
+                return False
+        a = self.type2test()
+        a[:] = [EvilCmp(a) for _ in xrange(100)]
+        # This used to seg fault before patch #1005778
+        self.assertRaises(ValueError, a.index, None)
+
     def test_reverse(self):
         u = self.type2test([-2, -1, 0, 1, 2])
         u2 = u[:]

Misc/NEWS

@@ -12,6 +12,10 @@ What's New in Python 2.4 alpha 3?
 Core and builtins
 -----------------
 
+- SF patch #1005778.  Fix a seg fault if the list size changed while
+  calling list.index().  This could happen if a rich comparison function
+  modified the list.
+
 - The ``func_name`` (a.k.a. ``__name__``) attribute of user-defined
   functions is now writable.
 

Objects/listobject.c

@@ -2186,9 +2186,7 @@ listindex(PyListObject *self, PyObject *args)
 		if (stop < 0)
 			stop = 0;
 	}
-	else if (stop > self->ob_size)
-		stop = self->ob_size;
-	for (i = start; i < stop; i++) {
+	for (i = start; i < stop && i < self->ob_size; i++) {
 		int cmp = PyObject_RichCompareBool(self->ob_item[i], v, Py_EQ);
 		if (cmp > 0)
 			return PyInt_FromLong((long)i);