[3.15] gh-160303: Fix bytearray state after a failed del b[:n] (GH-160304) (#161836)

After a failed `del b[:n]`, `bytearray_setslice_linear()` moved `ob_start` back, but `bytearray_resize_storage()` had already realigned the data and reset `ob_start`, so the bytearray then started `n` bytes before its buffer. The front-delete path now moves `ob_start` and the size before the shrinking resize and no longer restores anything, so a failed shrink leaves the bytes removed and the larger block in place, raising `MemoryError` as the non-front path already does. The checks in `bytearray_resize_lock_held()` are split from a new `bytearray_resize_unchecked()` so the slice code can call it directly without changing other callers, and the non-front failure path now writes the trailing null byte it was missing.

Fixes #160303

ANT-2026-QRZ6IDTC

<!-- gh-issue-number: gh-160303 -->
* Issue: gh-160303
<!-- /gh-issue-number -->

(cherry picked from commit 35e2c5a)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

Author: miss-islington

Lib/test/test_bytes.py

@@ -1590,6 +1590,10 @@ def test_resize(self):
     def test_resize_error(self):
         # gh-157242: If bytearray.resize() fails (MemoryError),
         # the bytearray must be left unchanged.
+        #
+        # gh-160303: If a slice is deleted or replaced by shorter data and
+        # shrinking the memory block fails (MemoryError), the bytearray
+        # must be modified anyway.
 
         offset = 3
         for logical_offset in (False, True):
@@ -1616,6 +1620,33 @@ def test_resize_error(self):
                     ba.resize(1)
                 self.assertEqual(ba, expected)
 
+                # shrink bytearray with a slice at the front, in the middle
+                # and at the end
+                data = b'0123456789'
+                if logical_offset:
+                    data = data[offset:]
+                for start, stop in ((0, -2), (1, -1), (2, len(data))):
+                    for replacement in (b'', b'.'):
+                        with self.subTest(start=start, stop=stop,
+                                          replacement=replacement):
+                            ba = bytearray(b'0123456789')
+                            if logical_offset:
+                                del ba[:offset]
+                            index = slice(start, stop)
+                            value = bytearray(replacement)
+                            expected = data[:start] + replacement + data[stop:]
+                            with inject_memory_error(self):
+                                if replacement:
+                                    ba[index] = value
+                                else:
+                                    del ba[index]
+                            self.assertEqual(ba, expected)
+                            # float() relies on the null byte after the data.
+                            self.assertEqual(float(ba), float(expected))
+                            ba.append(ord('5'))
+                            del ba[:1]
+                            self.assertEqual(ba, expected[1:] + b'5')
+
     def test_take_bytes(self):
         ba = bytearray(b'ab')
         self.assertEqual(ba.take_bytes(), b'ab')

Misc/NEWS.d/next/Core_and_Builtins/2026-10-22-15-40-00.gh-issue-160303.q7Zb2K.rst

@@ -0,0 +1,5 @@
+Fix :class:`bytearray` reading and writing memory outside of its buffer
+after ``del b[:n]`` or ``b[:n] = shorter`` failed with :exc:`MemoryError`.
+The bytes are now removed even if shrinking the memory block fails;
+:exc:`MemoryError` is still raised.  Also fix the missing null byte after the
+data when shrinking fails for a slice which is not at the front.

Objects/bytearrayobject.c

@@ -260,37 +260,31 @@ bytearray_resize_storage(PyByteArrayObject *self,
 }
 
 
+/* Resize without the checks of bytearray_resize_lock_held(): the caller must
+   have checked that the bytearray can be resized.
+
+   Unlike bytearray_resize_lock_held(), this does not return early if
+   requested_size is already the size of the bytearray.  A caller which
+   removed bytes by advancing ob_start and reducing the size uses that to
+   release the memory. */
 static int
-bytearray_resize_lock_held(PyObject *self, Py_ssize_t requested_size)
+bytearray_resize_unchecked(PyByteArrayObject *obj, Py_ssize_t requested_size)
 {
-    _Py_CRITICAL_SECTION_ASSERT_OBJECT_LOCKED(self);
-    PyByteArrayObject *obj = ((PyByteArrayObject *)self);
+    _Py_CRITICAL_SECTION_ASSERT_OBJECT_LOCKED(obj);
+    PyObject *self = (PyObject *)obj;
 
     assert(obj->ob_bytes_object != NULL);
+    assert(requested_size >= 0);
+    assert(obj->ob_exports == 0);
 
     /* All computations are done unsigned to avoid integer overflows
        (see issue #22335). */
     size_t alloc = (size_t) obj->ob_alloc;
     size_t logical_offset = (size_t) (obj->ob_start - obj->ob_bytes);
     size_t size = (size_t) requested_size;
 
-    assert(self != NULL);
-    assert(PyByteArray_Check(self));
     assert(logical_offset <= alloc);
 
-    if (requested_size < 0) {
-        PyErr_Format(PyExc_ValueError,
-            "Can only resize to positive sizes, got %zd", requested_size);
-        return -1;
-    }
-
-    if (requested_size == Py_SIZE(self)) {
-        return 0;
-    }
-    if (!_canresize(obj)) {
-        return -1;
-    }
-
     /* Resize to 0 resets to empty bytes (see issue #153419). */
     if (requested_size == 0) {
         Py_SETREF(obj->ob_bytes_object,
@@ -342,6 +336,30 @@ bytearray_resize_lock_held(PyObject *self, Py_ssize_t requested_size)
     return 0;
 }
 
+static int
+bytearray_resize_lock_held(PyObject *self, Py_ssize_t requested_size)
+{
+    _Py_CRITICAL_SECTION_ASSERT_OBJECT_LOCKED(self);
+    PyByteArrayObject *obj = ((PyByteArrayObject *)self);
+
+    assert(self != NULL);
+    assert(PyByteArray_Check(self));
+
+    if (requested_size < 0) {
+        PyErr_Format(PyExc_ValueError,
+            "Can only resize to positive sizes, got %zd", requested_size);
+        return -1;
+    }
+
+    if (requested_size == Py_SIZE(self)) {
+        return 0;
+    }
+    if (!_canresize(obj)) {
+        return -1;
+    }
+    return bytearray_resize_unchecked(obj, requested_size);
+}
+
 int
 PyByteArray_Resize(PyObject *self, Py_ssize_t requested_size)
 {
@@ -615,14 +633,22 @@ bytearray_setslice_linear(PyByteArrayObject *self,
             return -1;
 
         if (lo == 0) {
-            /* Shrink the buffer by advancing its logical start */
+            /* Shrink the buffer by advancing its logical start.  The bytes
+               are removed at this point; the resize below only releases
+               memory. */
             self->ob_start -= growth;
+            Py_SET_SIZE(self, Py_SIZE(self) + growth);
             /*
               0   lo               hi             old_size
               |   |<----avail----->|<-----tail------>|
               |      |<-bytes_len->|<-----tail------>|
               0    new_lo         new_hi          new_size
             */
+            if (bytearray_resize_unchecked(self, Py_SIZE(self)) < 0) {
+                /* The operation is completed, but a MemoryError is still
+                   raised and the memory block is not shrunk. */
+                res = -1;
+            }
         }
         else {
             /*
@@ -633,26 +659,17 @@ bytearray_setslice_linear(PyByteArrayObject *self,
             */
             memmove(buf + lo + bytes_len, buf + hi,
                     Py_SIZE(self) - hi);
-        }
-        if (bytearray_resize_lock_held((PyObject *)self,
-                               Py_SIZE(self) + growth) < 0) {
-            /* Issue #19578: Handling the memory allocation failure here is
-               tricky here because the bytearray object has already been
-               modified. Depending on growth and lo, the behaviour is
-               different.
-
-               If growth < 0 and lo != 0, the operation is completed, but a
-               MemoryError is still raised and the memory block is not
-               shrunk. Otherwise, the bytearray is restored in its previous
-               state and a MemoryError is raised. */
-            if (lo == 0) {
-                self->ob_start += growth;
-                return -1;
+            if (bytearray_resize_lock_held((PyObject *)self,
+                                           Py_SIZE(self) + growth) < 0) {
+                /* Issue #19578: memmove() removed bytes, the bytearray
+                   object cannot be restored in its previous state.
+
+                   The operation is completed, but a MemoryError is still
+                   raised and the memory block is not shrunk. */
+                Py_SET_SIZE(self, Py_SIZE(self) + growth);
+                bytearray_write_trailing_null_byte(self);
+                res = -1;
             }
-            /* memmove() removed bytes, the bytearray object cannot be
-               restored in its previous state. */
-            Py_SET_SIZE(self, Py_SIZE(self) + growth);
-            res = -1;
         }
         buf = PyByteArray_AS_STRING(self);
     }