diff options
| -rw-r--r-- | Objects/intobject.c | 9 | ||||
| -rw-r--r-- | Python/ceval.c | 8 |
2 files changed, 12 insertions, 5 deletions
diff --git a/Objects/intobject.c b/Objects/intobject.c index e73c921..ebe029e 100644 --- a/Objects/intobject.c +++ b/Objects/intobject.c @@ -465,7 +465,8 @@ int_add(PyIntObject *v, PyIntObject *w) register long a, b, x; CONVERT_TO_LONG(v, a); CONVERT_TO_LONG(w, b); - x = a + b; + /* casts in the line below avoid undefined behaviour on overflow */ + x = (long)((unsigned long)a + b); if ((x^a) >= 0 || (x^b) >= 0) return PyInt_FromLong(x); return PyLong_Type.tp_as_number->nb_add((PyObject *)v, (PyObject *)w); @@ -477,7 +478,8 @@ int_sub(PyIntObject *v, PyIntObject *w) register long a, b, x; CONVERT_TO_LONG(v, a); CONVERT_TO_LONG(w, b); - x = a - b; + /* casts in the line below avoid undefined behaviour on overflow */ + x = (long)((unsigned long)a - b); if ((x^a) >= 0 || (x^~b) >= 0) return PyInt_FromLong(x); return PyLong_Type.tp_as_number->nb_subtract((PyObject *)v, @@ -520,7 +522,8 @@ int_mul(PyObject *v, PyObject *w) CONVERT_TO_LONG(v, a); CONVERT_TO_LONG(w, b); - longprod = a * b; + /* casts in the next line avoid undefined behaviour on overflow */ + longprod = (long)((unsigned long)a * b); doubleprod = (double)a * (double)b; doubled_longprod = (double)longprod; diff --git a/Python/ceval.c b/Python/ceval.c index abe157e..6c71c27 100644 --- a/Python/ceval.c +++ b/Python/ceval.c @@ -1191,7 +1191,9 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag) register long a, b, i; a = PyInt_AS_LONG(v); b = PyInt_AS_LONG(w); - i = a + b; + /* cast to avoid undefined behaviour + on overflow */ + i = (long)((unsigned long)a + b); if ((i^a) < 0 && (i^b) < 0) goto slow_add; x = PyInt_FromLong(i); @@ -1221,7 +1223,9 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag) register long a, b, i; a = PyInt_AS_LONG(v); b = PyInt_AS_LONG(w); - i = a - b; + /* cast to avoid undefined behaviour + on overflow */ + i = (long)((unsigned long)a - b); if ((i^a) < 0 && (i^~b) < 0) goto slow_sub; x = PyInt_FromLong(i); |