diff options
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Objects/abstract.c | 9 |
2 files changed, 8 insertions, 4 deletions
@@ -13,6 +13,9 @@ Core and Builtins - Issue #27507: Add integer overflow check in bytearray.extend(). Patch by Xiang Zhang. +- Issue #27581: Don't rely on wrapping for overflow check in + PySequence_Tuple(). Patch by Xiang Zhang. + - Issue #27419: Standard __import__() no longer look up "__import__" in globals or builtins for importing submodules or "from import". Fixed a crash if raise a warning about unabling to resolve package from __spec__ or diff --git a/Objects/abstract.c b/Objects/abstract.c index 885d8de..5d8a44b 100644 --- a/Objects/abstract.c +++ b/Objects/abstract.c @@ -1747,21 +1747,22 @@ PySequence_Tuple(PyObject *v) break; } if (j >= n) { - Py_ssize_t oldn = n; + size_t newn = (size_t)n; /* The over-allocation strategy can grow a bit faster than for lists because unlike lists the over-allocation isn't permanent -- we reclaim the excess before the end of this routine. So, grow by ten and then add 25%. */ - n += 10; - n += n >> 2; - if (n < oldn) { + newn += 10u; + newn += newn >> 2; + if (newn > PY_SSIZE_T_MAX) { /* Check for overflow */ PyErr_NoMemory(); Py_DECREF(item); goto Fail; } + n = (Py_ssize_t)newn; if (_PyTuple_Resize(&result, n) != 0) { Py_DECREF(item); goto Fail; |