Issue #15989: Fix several occurrences of integer overflow

when result of PyInt_AsLong() or PyLong_AsLong() narrowed
to int without checks.

This is a backport of changesets 13e2e44db99d and 525407d89277.
This commit is contained in:
Serhiy Storchaka 2013-01-19 12:55:39 +02:00
parent ac7b49f407
commit 74f49ab28b
17 changed files with 143 additions and 22 deletions

View file

@ -8411,7 +8411,9 @@ PyObject *PyUnicode_Format(PyObject *format,
"* wants int");
goto onError;
}
width = PyInt_AsLong(v);
width = PyInt_AsSsize_t(v);
if (width == -1 && PyErr_Occurred())
goto onError;
if (width < 0) {
flags |= F_LJUST;
width = -width;
@ -8446,7 +8448,9 @@ PyObject *PyUnicode_Format(PyObject *format,
"* wants int");
goto onError;
}
prec = PyInt_AsLong(v);
prec = _PyInt_AsInt(v);
if (prec == -1 && PyErr_Occurred())
goto onError;
if (prec < 0)
prec = 0;
if (--fmtcnt >= 0)