Multiplying a string with a negative value crashes tinypy

[GoogleCodeExporter]

What steps will reproduce the problem?
1. Run the following code:

foo = "abc" * -1

What is the expected output? What do you see instead?

There is no expected output, but the program should finish gracefully.
Instead, it crashes tinypy.

If the value of foo is subsequently printed with the print() builtin,
tinypy outputs junk (probably random memory dump) to stdout.

What version of the product are you using? On what operating system?

Tested and confirmed on Slackware 12.1 and Windows XP SP2.

Please provide any additional information below.

The problem is that negative values aren't sanitised in tp_mul() when
allocating storage for the new string. I have modified tp_mul() to return
an empty string when multiplied by a negative value (like bigpy does).  

Original issue reported on code.google.com by denis.ka...@gmail.com on 18 Jun 2008 at 7:12

Attachments:

• ops.c

[GoogleCodeExporter]

Grumble. I attached the whole file by accident. Here is the patch.

Original comment by denis.ka...@gmail.com on 18 Jun 2008 at 7:17

Attachments:

• tp_mul.patch

[GoogleCodeExporter]

Please include a t_test("""....""") part in tests.py to demonstrate the bug and 
prove
the fix.

Original comment by philhas...@gmail.com on 18 Jun 2008 at 11:13

[GoogleCodeExporter]

Yes, sorry about that. Here it is.

Original comment by denis.ka...@gmail.com on 18 Jun 2008 at 11:37

Attachments:

• tp_mul.patch

[GoogleCodeExporter]

This patch could be a bit more concise.  No need for the else { } part.  

Original comment by philhas...@gmail.com on 20 Jun 2008 at 2:45

[GoogleCodeExporter]

Here is the revised version (diff against r57).

Original comment by denis.ka...@gmail.com on 20 Jun 2008 at 3:26

Attachments:

• tp_mul.patch

[GoogleCodeExporter]

Original comment by philhas...@gmail.com on 20 Jun 2008 at 3:33

• Changed state: Verified