Closes: #556025 seg fault when doing list(xrange(1e9))

A MemoryError is now raised when the list cannot be created.
There is a test, but as the comment says, it really only
works for 32 bit systems.  I don't know how to improve
the test for other systems (ie, 64 bit or systems
where the data size != addressable size,
e.g. 64 bit data, but 48 bit addressable memory)

2 files changed, 22 insertions, 2 deletions

diff --git a/Lib/test/test_b1.py b/Lib/test/test_b1.py
index 554e350..56a5f78 100644
--- a/Lib/test/test_b1.py
+++ b/Lib/test/test_b1.py
@@ -514,6 +514,17 @@ if list((0, 1, 2, 3)) != [0, 1, 2, 3]: raise TestFailed, 'list((0, 1, 2, 3))'
 if list('') != []: raise TestFailed, 'list('')'
 if list('spam') != ['s', 'p', 'a', 'm']: raise TestFailed, "list('spam')"
 
+try:
+    # Verify clearing of bug #556025
+    # this assumes that the max data size (sys.maxint) == max address size
+    # this also assumes that the address size is at least 4 bytes
+    # with 8 byte addresses, the bug is not well tested
+    list(xrange(sys.maxint / 4))
+except MemoryError:
+    pass
+else:
+    raise TestFailed, 'list(xrange(sys.maxint / 4))'
+
 print 'long'
 if long(314) != 314L: raise TestFailed, 'long(314)'
 if long(3.14) != 3L: raise TestFailed, 'long(3.14)'
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 44965157..83a8c70 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -44,7 +44,14 @@ roundupsize(int n)
 	return ((n >> nbits) + 1) << nbits;
  }
 
-#define NRESIZE(var, type, nitems) PyMem_RESIZE(var, type, roundupsize(nitems))
+#define NRESIZE(var, type, nitems)				\
+do {								\
+	size_t _new_size = roundupsize(nitems);			\
+	if (_new_size <= ((~(size_t)0) / sizeof(type)))		\
+		PyMem_RESIZE(var, type, _new_size);		\
+	else							\
+		var = NULL;					\
+} while (0)
 
 PyObject *
 PyList_New(int size)
@@ -1565,8 +1572,10 @@ list_fill(PyListObject *result, PyObject *v)
 	if (n < 0)
 		n = 8;	/* arbitrary */
 	NRESIZE(result->ob_item, PyObject*, n);
-	if (result->ob_item == NULL)
+	if (result->ob_item == NULL) {
+		PyErr_NoMemory();
 		goto error;
+	}
 	for (i = 0; i < n; i++)
 		result->ob_item[i] = NULL;
 	result->ob_size = n;