Issue #16096: Fix signed overflow in Objects/longobject.c. Thanks Serhiy Storchaka.

This commit is contained in:
Mark Dickinson 2012-10-06 18:50:02 +01:00
parent c04ddff290
commit fc9adb62fb
1 changed files with 2 additions and 3 deletions

View File

@ -668,10 +668,9 @@ _PyLong_NumBits(PyObject *vv)
assert(ndigits == 0 || v->ob_digit[ndigits - 1] != 0);
if (ndigits > 0) {
digit msd = v->ob_digit[ndigits - 1];
result = (ndigits - 1) * PyLong_SHIFT;
if (result / PyLong_SHIFT != (size_t)(ndigits - 1))
if ((size_t)(ndigits - 1) > PY_SIZE_MAX / (size_t)PyLong_SHIFT)
goto Overflow;
result = (size_t)(ndigits - 1) * (size_t)PyLong_SHIFT;
do {
++result;
if (result == 0)