diff options
| -rw-r--r-- | Modules/arraymodule.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c index 656f5a6..bb0a9ed 100644 --- a/Modules/arraymodule.c +++ b/Modules/arraymodule.c @@ -935,8 +935,15 @@ array_fromfile(self, args) char *item = self->ob_item; int itemsize = self->ob_descr->itemsize; int nread; - PyMem_RESIZE(item, char, (self->ob_size + n) * itemsize); + int newlength; + size_t newbytes; + /* Be careful here about overflow */ + if ((newlength = self->ob_size + n) <= 0 || + (newbytes = newlength * itemsize) / itemsize != newlength) + goto nomem; + PyMem_RESIZE(item, char, newbytes); if (item == NULL) { + nomem: PyErr_NoMemory(); return NULL; } |