Summary

This PR resolves an off-by-one buffer overflow in py/objdeque.c when using deque with indexing. The error occurs when appending data beyond the size of the allocated buffer (discarding items from the opposite end) without overflow checking.

Reproduction

The following code demonstrates the issue on all boards/ports:

from collections import deque

d = deque((), 2)

for i in range(4):
    d.append(i)
    print(f"{i=} {d[-1]=}")

Expected Output

i=0 d[-1]=0
i=1 d[-1]=1
i=2 d[-1]=2
i=3 d[-1]=3

Actual Output

i=0 d[-1]=0
i=1 d[-1]=1
i=2 d[-1]=2
Traceback (most recent call last):
  File "/tmp/deque_fail.py", line 7, in <module>
TypeError: 'deque' object isn't subscriptable

Root Cause

The issue arises from an off-by-one error in deque_subscr(). If index_val equals self->alloc, the necessary index correction index_val -= self->alloc is skipped, leading to an out-of-bounds access when self->items[index_val] is called. Since self->items has a length of self->alloc, this results in a buffer overflow.

This fix ensures that the index correction is applied whenever index_val >= self->alloc, preventing access beyond the allocated buffer size.

Testing

Tested on unix and esp32 port.