From a1e42e11d51237a949ad2568f8a097d4b442fdec Mon Sep 17 00:00:00 2001
From: Armin Rigo <arigo@tunes.org>
Date: Wed, 17 Oct 2007 18:46:37 +0000
Subject: [PATCH] Fix the overflow checking of list_repeat. Introduce overflow
 checking into list_inplace_repeat.

Backport candidate, possibly.
---
 Lib/test/test_list.py |  9 +++++++++
 Objects/listobject.c  | 11 +++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/Lib/test/test_list.py b/Lib/test/test_list.py
index 711ac4b75c9..34895290a64 100644
--- a/Lib/test/test_list.py
+++ b/Lib/test/test_list.py
@@ -1,4 +1,5 @@
 import unittest
+import sys
 from test import test_support, list_tests
 
 class ListTest(list_tests.CommonTest):
@@ -18,6 +19,14 @@ class ListTest(list_tests.CommonTest):
         self.assertEqual(len([0]), 1)
         self.assertEqual(len([0, 1, 2]), 3)
 
+    def test_overflow(self):
+        lst = [4, 5, 6, 7]
+        n = int((sys.maxint*2+2) // len(lst))
+        def mul(a, b): return a * b
+        def imul(a, b): a *= b
+        self.assertRaises((MemoryError, OverflowError), mul, lst, n)
+        self.assertRaises((MemoryError, OverflowError), imul, lst, n)
+
 def test_main(verbose=None):
     test_support.run_unittest(ListTest)
 
diff --git a/Objects/listobject.c b/Objects/listobject.c
index a3fa983c59b..fb5ce82cb0e 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -499,10 +499,10 @@ list_repeat(PyListObject *a, Py_ssize_t n)
 	if (n < 0)
 		n = 0;
 	size = Py_Size(a) * n;
-	if (size == 0)
-              return PyList_New(0);
 	if (n && size/n != Py_Size(a))
 		return PyErr_NoMemory();
+	if (size == 0)
+              return PyList_New(0);
 	np = (PyListObject *) PyList_New(size);
 	if (np == NULL)
 		return NULL;
@@ -669,7 +669,7 @@ static PyObject *
 list_inplace_repeat(PyListObject *self, Py_ssize_t n)
 {
 	PyObject **items;
-	Py_ssize_t size, i, j, p;
+	Py_ssize_t size, i, j, p, newsize;
 
 
 	size = PyList_GET_SIZE(self);
@@ -684,7 +684,10 @@ list_inplace_repeat(PyListObject *self, Py_ssize_t n)
 		return (PyObject *)self;
 	}
 
-	if (list_resize(self, size*n) == -1)
+	newsize = size * n;
+	if (newsize/n != size)
+		return PyErr_NoMemory();
+	if (list_resize(self, newsize) == -1)
 		return NULL;
 
 	p = size;