traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Issue #27581: Merge overflow fix from 3.5

This commit is contained in:
Martin Panter 2016-07-25 03:31:29 +00:00
parent c665dfd73e e8db861f47
commit 32d2ce3561
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Misc/NEWS
View File

@ -13,6 +13,9 @@ Core and Builtins
- Issue #27507: Add integer overflow check in bytearray.extend(). Patch by - Issue #27507: Add integer overflow check in bytearray.extend(). Patch by
Xiang Zhang. Xiang Zhang.
- Issue #27581: Don't rely on wrapping for overflow check in
PySequence_Tuple(). Patch by Xiang Zhang.
- Issue #27419: Standard __import__() no longer look up "__import__" in globals - Issue #27419: Standard __import__() no longer look up "__import__" in globals
or builtins for importing submodules or "from import". Fixed a crash if or builtins for importing submodules or "from import". Fixed a crash if
raise a warning about unabling to resolve package from __spec__ or raise a warning about unabling to resolve package from __spec__ or

9
Objects/abstract.c
View File

@ -1747,21 +1747,22 @@ PySequence_Tuple(PyObject *v)
break; break;
} }
if (j >= n) { if (j >= n) {
Py_ssize_t oldn = n; size_t newn = (size_t)n;
/* The over-allocation strategy can grow a bit faster /* The over-allocation strategy can grow a bit faster
than for lists because unlike lists the than for lists because unlike lists the
over-allocation isn't permanent -- we reclaim over-allocation isn't permanent -- we reclaim
the excess before the end of this routine. the excess before the end of this routine.
So, grow by ten and then add 25%. So, grow by ten and then add 25%.
*/ */
n += 10; newn += 10u;
n += n >> 2; newn += newn >> 2;
if (n < oldn) { if (newn > PY_SSIZE_T_MAX) {
/* Check for overflow */ /* Check for overflow */
PyErr_NoMemory(); PyErr_NoMemory();
Py_DECREF(item); Py_DECREF(item);
goto Fail; goto Fail;
} }
n = (Py_ssize_t)newn;
if (_PyTuple_Resize(&result, n) != 0) { if (_PyTuple_Resize(&result, n) != 0) {
Py_DECREF(item); Py_DECREF(item);
goto Fail; goto Fail;