Issue #15989: Fix several occurrences of integer overflow

when result of PyLong_AsLong() narrowed to int without checks.

This is a backport of changesets 13e2e44db99d and 525407d89277.

3 files changed, 22 insertions, 4 deletions

diff --git a/Objects/fileobject.c b/Objects/fileobject.c
index e1c47ce..3a31314 100644
--- a/Objects/fileobject.c
+++ b/Objects/fileobject.c
@@ -200,7 +200,7 @@ PyObject_AsFileDescriptor(PyObject *o)
     _Py_IDENTIFIER(fileno);
 
     if (PyLong_Check(o)) {
-        fd = PyLong_AsLong(o);
+        fd = _PyLong_AsInt(o);
     }
     else if ((meth = _PyObject_GetAttrId(o, &PyId_fileno)) != NULL)
     {
@@ -210,7 +210,7 @@ PyObject_AsFileDescriptor(PyObject *o)
             return -1;
 
         if (PyLong_Check(fno)) {
-            fd = PyLong_AsLong(fno);
+            fd = _PyLong_AsInt(fno);
             Py_DECREF(fno);
         }
         else {
diff --git a/Objects/longobject.c b/Objects/longobject.c
index 9535830..32ccdc3 100644
--- a/Objects/longobject.c
+++ b/Objects/longobject.c
@@ -434,6 +434,24 @@ PyLong_AsLong(PyObject *obj)
     return result;
 }
 
+/* Get a C int from a long int object or any object that has an __int__
+   method.  Return -1 and set an error if overflow occurs. */
+
+int
+_PyLong_AsInt(PyObject *obj)
+{
+    int overflow;
+    long result = PyLong_AsLongAndOverflow(obj, &overflow);
+    if (overflow || result > INT_MAX || result < INT_MIN) {
+        /* XXX: could be cute and give a different
+           message for overflow == -1 */
+        PyErr_SetString(PyExc_OverflowError,
+                        "Python int too large to convert to C int");
+        return -1;
+    }
+    return (int)result;
+}
+
 /* Get a Py_ssize_t from a long int object.
    Returns -1 and sets an error condition if overflow occurs. */
 
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 044b26e..b57a896 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -13569,7 +13569,7 @@ PyUnicode_Format(PyObject *format, PyObject *args)
                                     "* wants int");
                     goto onError;
                 }
-                width = PyLong_AsLong(v);
+                width = PyLong_AsSsize_t(v);
                 if (width == -1 && PyErr_Occurred())
                     goto onError;
                 if (width < 0) {
@@ -13609,7 +13609,7 @@ PyUnicode_Format(PyObject *format, PyObject *args)
                                         "* wants int");
                         goto onError;
                     }
-                    prec = PyLong_AsLong(v);
+                    prec = _PyLong_AsInt(v);
                     if (prec == -1 && PyErr_Occurred())
                         goto onError;
                     if (prec < 0)