[Numpy-tickets] [NumPy] #614: SegFault/double free with simple array mask operation

[NumPy]

#614: SegFault/double free with simple array mask operation
---------------------------------------------------+------------------------
 Reporter:  AchimGaedke                            |        Owner:  somebody
     Type:  defect                                 |       Status:  new     
 Priority:  high                                   |    Milestone:          
Component:  numpy.core                             |      Version:          
 Severity:  major                                  |   Resolution:          
 Keywords:  SegmenationFault, MaskedArrays, Patch  |  
---------------------------------------------------+------------------------
Changes (by AchimGaedke):

  * keywords:  SegmenationFault, MaskedArrays => SegmenationFault,
               MaskedArrays, Patch

Comment:

 Patch for Segmentation Fault/double free bug

 Index: arrayobject.c
 ===================================================================
 --- arrayobject.c       (revision 4464)
 +++ arrayobject.c       (working copy)
 @@ -9337,6 +9337,11 @@
          return -1;
      }
      index = ind->dimensions[0];
 +    if (index > self->size) {
 +        PyErr_SetString(PyExc_ValueError,
 +                        "too many boolean indices");
 +        return -1;
 +    }
      strides = ind->strides[0];
      dptr = ind->data;
      PyArray_ITER_RESET(self);

-- 
Ticket URL: <http://scipy.org/scipy/numpy/ticket/614#comment:1>
NumPy <http://projects.scipy.org/scipy/numpy>
The fundamental package needed for scientific computing with Python.