Also check if the ob_item's size is changed by user's code

Author: aisk

Lib/test/test_array.py

@@ -1697,6 +1697,19 @@ def __index__(self):
 
         self.assertEqual(len(victim), 0)
 
+        # Test case where array is shrunk but not completely cleared
+        victim2 = array.array('b', [1, 2, 3])
+
+        class ShrinkIndex:
+            def __index__(self):
+                # Pop two elements, making array size 1, so index 1 is out of bounds
+                victim2.pop()
+                victim2.pop()
+                return 0
+
+        with self.assertRaises(IndexError):
+            victim2[1] = ShrinkIndex()
+
 
 if __name__ == "__main__":
     unittest.main()

Modules/arraymodule.c

@@ -222,10 +222,10 @@ b_setitem(arrayobject *ap, Py_ssize_t i, PyObject *v)
     if (!PyArg_Parse(v, "h;array item must be integer", &x))
         return -1;
 
-    /* Check buffer validity after PyArg_Parse which may call user-defined
+    /* Check buffer validity and bounds after PyArg_Parse which may call user-defined
      * __index__ on v, which might modify the array buffer. See gh-142555.
      */
-    if (i >= 0 && ap->ob_item == NULL) {
+    if (i >= 0 && (ap->ob_item == NULL || i >= Py_SIZE(ap))) {
         PyErr_SetString(PyExc_IndexError,
             "array assignment index out of range");
         return -1;