diff options
| author | Mark Dickinson <dickinsm@gmail.com> | 2009-12-02 17:33:41 (GMT) |
|---|---|---|
| committer | Mark Dickinson <dickinsm@gmail.com> | 2009-12-02 17:33:41 (GMT) |
| commit | 34398184eb241dcc42ae0ed117c8be6e7a445495 (patch) | |
| tree | 7a8bf408c30d5f219661c09902d1452503d5fc64 /Objects | |
| parent | 5a73ff81f1caf8f7c13c459ac450f33695d2e626 (diff) | |
| download | cpython-34398184eb241dcc42ae0ed117c8be6e7a445495.zip cpython-34398184eb241dcc42ae0ed117c8be6e7a445495.tar.gz cpython-34398184eb241dcc42ae0ed117c8be6e7a445495.tar.bz2 | |
Issue #7406: Fix some occurrences of potential signed overflow in int
arithmetic.
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/intobject.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/Objects/intobject.c b/Objects/intobject.c index dce569a..43dedf2 100644 --- a/Objects/intobject.c +++ b/Objects/intobject.c @@ -461,7 +461,8 @@ int_add(PyIntObject *v, PyIntObject *w) register long a, b, x; CONVERT_TO_LONG(v, a); CONVERT_TO_LONG(w, b); - x = a + b; + /* casts in the line below avoid undefined behaviour on overflow */ + x = (long)((unsigned long)a + b); if ((x^a) >= 0 || (x^b) >= 0) return PyInt_FromLong(x); return PyLong_Type.tp_as_number->nb_add((PyObject *)v, (PyObject *)w); @@ -473,7 +474,8 @@ int_sub(PyIntObject *v, PyIntObject *w) register long a, b, x; CONVERT_TO_LONG(v, a); CONVERT_TO_LONG(w, b); - x = a - b; + /* casts in the line below avoid undefined behaviour on overflow */ + x = (long)((unsigned long)a - b); if ((x^a) >= 0 || (x^~b) >= 0) return PyInt_FromLong(x); return PyLong_Type.tp_as_number->nb_subtract((PyObject *)v, @@ -516,7 +518,8 @@ int_mul(PyObject *v, PyObject *w) CONVERT_TO_LONG(v, a); CONVERT_TO_LONG(w, b); - longprod = a * b; + /* casts in the next line avoid undefined behaviour on overflow */ + longprod = (long)((unsigned long)a * b); doubleprod = (double)a * (double)b; doubled_longprod = (double)longprod; |