diff options
Diffstat (limited to 'Modules/arraymodule.c')
| -rw-r--r-- | Modules/arraymodule.c | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c index da2e9c2..3e26369 100644 --- a/Modules/arraymodule.c +++ b/Modules/arraymodule.c @@ -421,6 +421,9 @@ newarrayobject(PyTypeObject *type, Py_ssize_t size, struct arraydescr *descr) if (op == NULL) { return NULL; } + op->ob_descr = descr; + op->allocated = size; + op->weakreflist = NULL; Py_SIZE(op) = size; if (size <= 0) { op->ob_item = NULL; @@ -428,13 +431,10 @@ newarrayobject(PyTypeObject *type, Py_ssize_t size, struct arraydescr *descr) else { op->ob_item = PyMem_NEW(char, nbytes); if (op->ob_item == NULL) { - PyObject_Del(op); + Py_DECREF(op); return PyErr_NoMemory(); } } - op->ob_descr = descr; - op->allocated = size; - op->weakreflist = NULL; op->ob_exports = 0; return (PyObject *) op; } @@ -808,11 +808,15 @@ array_do_extend(arrayobject *self, PyObject *bb) "can only extend with array of same kind"); return -1; } + if ((Py_SIZE(self) > PY_SSIZE_T_MAX - Py_SIZE(b)) || + ((Py_SIZE(self) + Py_SIZE(b)) > PY_SSIZE_T_MAX / self->ob_descr->itemsize)) { + PyErr_NoMemory(); + return -1; + } size = Py_SIZE(self) + Py_SIZE(b); PyMem_RESIZE(self->ob_item, char, size*self->ob_descr->itemsize); if (self->ob_item == NULL) { - PyObject_Del(self); - PyErr_NoMemory(); + PyErr_NoMemory(); return -1; } memcpy(self->ob_item + Py_SIZE(self)*self->ob_descr->itemsize, |