Commits

pv committed d7198b9

memoryview: always check return value from _get_shape0

Comments (0)

Files changed (1)

Objects/memoryobject.c

     if (key == Py_Ellipsis) {
         start = 0;
         len = _get_shape0(view);
+        if (len < 0) {
+            return -1;
+        }
     }
     else if (PyIndex_Check(key)) {
         start = PyNumber_AsSsize_t(key, NULL);
 _get_real_index0(Py_buffer *view, Py_ssize_t index0)
 {
     Py_ssize_t shape0 = _get_shape0(view);
+    if (shape0 < 0) {
+        return -1;
+    }
     if (index0 < 0) {
         index0 += shape0;
     }
     PyMemoryViewObject *mem;
     Py_buffer *view;
     char *ptr;
+    Py_ssize_t shape0;
 
     view = &parent->view;
     ptr = _get_pointer_index0(view, index0);
-
-    if (ptr == NULL) {
+    shape0 = _get_shape0(view);
+    
+    if (ptr == NULL || shape0 < 0) {
         return NULL;
     }
 
         return NULL;
     }
     mem->view.readonly = view->readonly;
-    mem->view.len = view->len / _get_shape0(view);
+    mem->view.len = view->len / shape0;
     mem->view.itemsize = view->itemsize;
     mem->view.ndim = view->ndim - 1;
     
 {
     PyMemoryViewObject *mem;
     Py_buffer *view;
-    Py_ssize_t stride0;
+    Py_ssize_t shape0, stride0;
     Py_ssize_t start, stop, step, slicelength;
 
     view = &parent->view;
         return NULL;
     }
 
-    if (PySlice_GetIndicesEx(slice, _get_shape0(view),
+    shape0 = _get_shape0(view);
+    if (shape0 < 0) {
+        return NULL;
+    }
+
+    if (PySlice_GetIndicesEx(slice, shape0,
                              &start, &stop, &step, &slicelength) < 0) {
         return NULL;
     }