diff options
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Objects/abstract.c | 9 |
2 files changed, 8 insertions, 4 deletions
@@ -25,6 +25,9 @@ Core and Builtins - Issue #27507: Add integer overflow check in bytearray.extend(). Patch by Xiang Zhang. +- Issue #27581: Don't rely on wrapping for overflow check in + PySequence_Tuple(). Patch by Xiang Zhang. + - Issue #27443: __length_hint__() of bytearray iterators no longer return a negative integer for a resized bytearray. diff --git a/Objects/abstract.c b/Objects/abstract.c index 585992d..88205bd 100644 --- a/Objects/abstract.c +++ b/Objects/abstract.c @@ -1724,21 +1724,22 @@ PySequence_Tuple(PyObject *v) break; } if (j >= n) { - Py_ssize_t oldn = n; + size_t newn = (size_t)n; /* The over-allocation strategy can grow a bit faster than for lists because unlike lists the over-allocation isn't permanent -- we reclaim the excess before the end of this routine. So, grow by ten and then add 25%. */ - n += 10; - n += n >> 2; - if (n < oldn) { + newn += 10u; + newn += newn >> 2; + if (newn > PY_SSIZE_T_MAX) { /* Check for overflow */ PyErr_NoMemory(); Py_DECREF(item); goto Fail; } + n = (Py_ssize_t)newn; if (_PyTuple_Resize(&result, n) != 0) { Py_DECREF(item); goto Fail; |