Merge in release25-maint r60793:

Added checks for integer overflows, contributed by Google. Some are
 only available if asserts are left in the code, in cases where they
 can't be triggered from Python code.

Python/ast.c

@@ -3200,6 +3200,9 @@ decode_unicode(struct compiling *c, const char *s, size_t len, int rawmode, cons
                 buf = (char *)s;
                 u = NULL;
         } else {
+                /* check for integer overflow */
+                if (len > PY_SIZE_MAX / 4)
+                        return NULL;
                 /* "\XX" may become "\u005c\uHHLL" (12 bytes) */
                 u = PyString_FromStringAndSize((char *)NULL, len * 4);
                 if (u == NULL)