1# 2# The various methods of bufferobject.c (here buffer_subscript()) call 3# get_buf() before calling potentially more Python code (here via 4# PySlice_GetIndicesEx()). But get_buf() already returned a void* 5# pointer. This void* pointer can become invalid if the object 6# underlying the buffer is mutated (here a bytearray object). 7# 8# As usual, please keep in mind that the three "here" in the sentence 9# above are only examples. Each can be changed easily and lead to 10# another crasher. 11# 12# This crashes for me on Linux 32-bits with CPython 2.6 and 2.7 13# with a segmentation fault. 14# 15 16 17class PseudoIndex(object): 18 def __index__(self): 19 for c in "foobar"*n: 20 a.append(c) 21 return n * 4 22 23 24for n in range(1, 100000, 100): 25 a = bytearray("test"*n) 26 buf = buffer(a) 27 28 s = buf[:PseudoIndex():1] 29 #print repr(s) 30 #assert s == "test"*n 31