BUG: Fix out-of-bounds segfault in pad_object and backfill_object methods

Author: wesm

RELEASE.rst

@@ -217,7 +217,9 @@ pandas 0.7.0
   - Catch misreported console size when running IPython within Emacs
   - Fix minor bug in pivot table margins, loss of index names and length-1
     'All' tuple in row labels
-  - Add support for legacy
+  - Add support for legacy WidePanel objects to be read from HDFStore
+  - Fix out-of-bounds segfault in pad_object and backfill_object methods when
+    either source or target array are empty
 
 Thanks
 ------

pandas/src/generate_code.py

@@ -147,6 +147,9 @@ def backfill_%(name)s(ndarray[%(c_type)s] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = oldLength - 1
     newPos = newLength - 1
 
@@ -221,6 +224,9 @@ def pad_%(name)s(ndarray[%(c_type)s] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = 0
     newPos = 0
 

pandas/src/generated.pyx

@@ -216,6 +216,9 @@ def pad_float64(ndarray[float64_t] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = 0
     newPos = 0
 
@@ -271,6 +274,9 @@ def pad_object(ndarray[object] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = 0
     newPos = 0
 
@@ -326,6 +332,9 @@ def pad_int32(ndarray[int32_t] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = 0
     newPos = 0
 
@@ -381,6 +390,9 @@ def pad_int64(ndarray[int64_t] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = 0
     newPos = 0
 
@@ -436,6 +448,9 @@ def pad_bool(ndarray[uint8_t] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = 0
     newPos = 0
 
@@ -492,6 +507,9 @@ def backfill_float64(ndarray[float64_t] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = oldLength - 1
     newPos = newLength - 1
 
@@ -541,6 +559,9 @@ def backfill_object(ndarray[object] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = oldLength - 1
     newPos = newLength - 1
 
@@ -590,6 +611,9 @@ def backfill_int32(ndarray[int32_t] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = oldLength - 1
     newPos = newLength - 1
 
@@ -639,6 +663,9 @@ def backfill_int64(ndarray[int64_t] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = oldLength - 1
     newPos = newLength - 1
 
@@ -688,6 +715,9 @@ def backfill_bool(ndarray[uint8_t] oldIndex,
     fill_vec = np.empty(len(newIndex), dtype = np.int32)
     fill_vec.fill(-1)
 
+    if oldLength == 0 or newLength == 0:
+        return fill_vec
+
     oldPos = oldLength - 1
     newPos = newLength - 1
 

pandas/tests/test_tseries.py

@@ -236,6 +236,32 @@ def test_get_reverse_indexer():
     expected = np.array([4, 2, 3, 6, 7], dtype='i4')
     assert(np.array_equal(result, expected))
 
+def test_pad_backfill_object_segfault():
+    from datetime import datetime
+    old = np.array([], dtype='O')
+    new = np.array([datetime(2010, 12, 31)], dtype='O')
+
+    result = lib.pad_object(old, new, lib.map_indices_object(old),
+                            lib.map_indices_object(new))
+    expected = np.array([-1], dtype='i4')
+    assert(np.array_equal(result, expected))
+
+    result = lib.pad_object(new, old, lib.map_indices_object(new),
+                            lib.map_indices_object(old))
+    expected = np.array([], dtype='i4')
+    assert(np.array_equal(result, expected))
+
+    result = lib.backfill_object(old, new, lib.map_indices_object(old),
+                                 lib.map_indices_object(new))
+    expected = np.array([-1], dtype='i4')
+    assert(np.array_equal(result, expected))
+
+    result = lib.backfill_object(new, old, lib.map_indices_object(new),
+                            lib.map_indices_object(old))
+    expected = np.array([], dtype='i4')
+    assert(np.array_equal(result, expected))
+
+
 class TestTypeInference(unittest.TestCase):
 
     def test_integers(self):

setup.py

@@ -167,7 +167,7 @@
 MAJOR = 0
 MINOR = 7
 MICRO = 0
-ISRELEASED = True
+ISRELEASED = False
 VERSION = '%d.%d.%d' % (MAJOR, MINOR, MICRO)
 QUALIFIER = 'rc1'